Accounting is where "open source" claims most need checking. We read the LICENSE file of every project below, not just the GitHub badge, and dropped anything archived or untouched for over a year. Star and commit figures are GitHub snapshots from early October 2026; each app page shows live numbers.

Open-source accounting software compared

Browse the full list in the Accounting & Invoicing category.

Bigcapital: the best dedicated accounting app

• Bigcapital: Financial accounting and inventory management software for small to medium businesses.

Bigcapital is accounting and inventory software for small and medium businesses. It keeps double-entry books, produces financial statements and exposes an API so other systems can post transactions into it ("headless accounting").

• Pros: AGPL-3.0 with no paid edition gating the core; official Docker and Docker Compose guide; active development (over 1,000 commits in the last year).
• Cons: still versioned below 1.0 (v0.25 at the time of writing), so expect changes between releases; a smaller community than the big ERPs.

ERPNext: full accounting inside an open ERP

• ERPNext: ERP system to help you run your business.

ERPNext's accounting module covers everything from recording transactions to financial reports, and it is wired to sales, purchasing, stock, manufacturing and projects. Every part is GPL-3.0 with no closed edition.

• Pros: the most complete open-source books here, including multiple companies; one system for invoices, stock and accounts; official Docker setup.
• Cons: you run a full ERP stack (Python, MariaDB, Redis) even if you only want the ledger; setting up a chart of accounts and workflows takes time.

If you are also considering a lighter ERP, read ERPNext vs Dolibarr.

LedgerSMB: traditional double-entry accounting

• LedgerSMB: Integrated accounting and ERP system for small and midsize businesses, with double entry accounting, budgeting, invoicing, quotations, projects, orders and inventory management, shipping and more.

LedgerSMB is a web-based double-entry accounting system with quotations, ordering, invoicing, projects, timecards, inventory and shipping, storing its data in PostgreSQL. It has been around for many years and is aimed squarely at small and midsize businesses.

• Pros: proper accounting-first design; an official Docker Compose setup; GPL-2.0.
• Cons: a Perl codebase and a more traditional interface; a small community (570 stars), though development is steady.

Odoo: invoicing as part of a larger suite

• Odoo: Free open source ERP system.

Odoo's LGPL-3.0 Community edition includes invoicing alongside CRM, sales, inventory and POS. The full Accounting app and several other features are Enterprise-only, so check Odoo's edition comparison before relying on it for your books. See Odoo vs ERPNext.

Akaunting: polished, with real limits

• Akaunting: Accounting software designed for small businesses and freelancers.

Akaunting is a Laravel and Vue accounting app for small businesses and freelancers, with an App Store for extensions and support for MariaDB, MySQL, PostgreSQL or SQLite. It is one of the most-starred projects in this space, but its licence is the Business Source License 1.1. Free production use is limited to two users, one company and 1,000 invoices, and you may not rebrand it or offer it as an accounting service. Each version becomes GPLv3 four years after release.

• Pros: friendly interface; flexible database support; good fit for a sole trader inside the limits.
• Cons: not OSI open source; outgrow the limits and you need a paid on-premise plan.

Invoice Ninja: the most complete invoicing app

• Invoice Ninja: Powerful tool to invoice clients online.

Invoice Ninja 5 handles quotes, invoices, recurring billing, payments, expenses and a client portal, with official desktop and mobile apps that connect to self-hosted servers. The self-hosted code includes all Pro and Enterprise features; a $40-per-year white-label licence removes the branding.

• Pros: the richest invoicing feature set; Docker image plus Cloudron, Softaculous and YunoHost packages.
• Cons: the Elastic License 2.0 is source-available, and forbids offering Invoice Ninja to others as a hosted service. It is invoicing, not full double-entry accounting.

Compare the two directly in Akaunting vs Invoice Ninja.

InvoiceShelf: OSI-licensed invoicing

• InvoiceShelf: Track expenses, payments & create professional invoices & estimates (fork of Crater).

InvoiceShelf, a fork of Crater, covers invoices and estimates with PDF export, payments, expenses, taxes, recurring invoices, a customer portal and multiple companies, under AGPL-3.0. A public demo resets automatically.

• Pros: genuinely open source; official Docker Compose setup with a SQLite option for small installs.
• Cons: the default 3.x branch is an alpha preview, so use the 2.x release for production data, as the README advises.

Plain-text accounting: hledger and Fava

• hledger: Plain text double-entry accounting with command-line, terminal and web interfaces, multi-currency support and CSV import.
• Fava: Web frontend of Beancount, a text based double-entry accounting system.

If you are comfortable with text files and version control, hledger (GPL-3.0) keeps double-entry books in plain text and offers command-line, terminal and web interfaces, with strong CSV import. Fava is a web interface for the Beancount format. Both are excellent for freelancers and technical founders who want full control and an audit trail in Git, but they are not point-and-click tools for a bookkeeper.

Other tools worth a look

• InvoicePlane (MIT) and SolidInvoice (MIT): mature, focused invoicing for small businesses.
• Invoicerr (AGPL-3.0): freelancer invoicing with e-invoice XML formats such as Factur-X, UBL, XRechnung and Peppol BIS, useful where e-invoicing is mandatory.
• Invio (public domain, Unlicense): deliberately minimal; create an invoice, share a link, get paid.
• TaxHacker (MIT): uses an LLM of your choice, including a local one, to extract data from receipts and invoices. Its README says it is early in development, so treat it as a helper, not your system of record.
• ERPSAAS (MIT): a Laravel double-entry accounting platform, though only a handful of commits landed in the last year.

Open source vs source-available: why it matters for your books

Your accounting data has to stay readable for years, often for as long as tax authorities can audit you. That makes the licence more than a technicality. With an OSI licence such as GPL, AGPL or MIT, you, a contractor or a community fork can keep the software running even if the original company changes direction. With a source-available licence, the vendor sets the rules: Akaunting's BSL caps free use by users, companies and invoice count, and Invoice Ninja's Elastic License blocks anyone from running it as a service for others.

Neither is a reason to avoid those apps outright. Invoice Ninja's terms do not affect a business hosting it for its own invoicing, and a sole trader can stay inside Akaunting's limits. Just make the choice knowingly, and keep regular exports of your data in an open format.

Before you migrate your books

• Pick a clean cut-over date, usually the start of a month or financial year, and enter opening balances from your old system's trial balance rather than importing years of history.
• Export everything from the old tool first: customers, suppliers, items, open invoices and the chart of accounts, in CSV where possible.
• Check the features your jurisdiction needs: multi-currency, tax rates and reports, e-invoicing formats and audit trails differ a lot between these apps.
• Give your accountant access or agree on an export format before year-end, so closing the books does not become a data-conversion project.
• Automate backups of the database and uploaded files, and test a restore.

How to choose

• You need real books (balance sheet, P&L, reconciliation) for a small company: Bigcapital, or LedgerSMB if you prefer a long-established project.
• You also manage stock, purchasing or manufacturing: ERPNext.
• You mainly send invoices and chase payments: Invoice Ninja, or InvoiceShelf if you want an OSI licence.
• You are a freelancer who likes text files: hledger or Fava.
• You are replacing a specific product: see our open-source alternatives to QuickBooks, Xero, FreshBooks, Wave, Zoho Books and Sage.

Whichever you pick, back up the database off-site and test a restore before tax season. If you also run a shop, our best open-source POS systems roundup covers the till side, and for managing customers see the best open-source CRM.

Per-user pricing is what makes Salesforce, HubSpot and Pipedrive expensive as a team grows. A self-hosted CRM costs the same for five users or fifty: a server and some of your time. We looked at every actively maintained CRM in the appsgit catalog, checked each licence and README, and left out anything archived or inactive for more than a year. Star and commit figures are GitHub snapshots from early October 2026; app pages show live numbers.

Open-source CRMs compared

Browse all of them in the CRM category.

A note on licences: most of these CRMs are AGPL-3.0. You can self-host and modify them freely for your own business; the copyleft obligation to publish your changes applies when you let other people use a modified version over a network. Krayin, BottleCRM and Atomic CRM are MIT, which also allows closed-source modifications, so they suit agencies building a CRM product for clients.

Twenty: the modern, programmable CRM

• Twenty: A modern CRM offering the flexibility of open source, advanced features, and a sleek design.

Twenty is the most-starred CRM in the appsgit catalog and one of the most actively developed projects in it. It gives you objects, fields, table and kanban views and workflows, and it lets developers define apps, objects and views as code with its SDK and CLI.

• Pros: the most modern interface and data model here; custom objects for any process; official Docker Compose setup; very active development.
• Cons: needs Node.js, PostgreSQL and Redis; files marked Enterprise are under a commercial licence; younger than SuiteCRM, with a smaller integration ecosystem.

Krayin: the simplest CRM to host

• Krayin: CRM solution for SMEs and Enterprises for complete customer lifecycle management.

Krayin is a Laravel and Vue CRM for small and midsize businesses, with lead pipelines on kanban boards, an admin dashboard, custom attributes and email parsing via SendGrid, all on a modular structure. It is MIT-licensed and runs on standard PHP hosting with MySQL, with Docker installation documented.

• Pros: permissive MIT licence; easy for PHP developers to extend; live demo.
• Cons: add-ons such as WhatsApp, VoIP and multi-tenant SaaS are offered as separate extensions on krayincrm.com; less built-in depth than SuiteCRM or EspoCRM for support cases and campaigns.

Twenty or Krayin? See Twenty vs Krayin.

SuiteCRM: the mature enterprise option

• SuiteCRM: The award-winning, enterprise-class open source CRM.

SuiteCRM descends from SugarCRM Community Edition and is the long-standing enterprise CRM in open source: accounts, contacts, leads, opportunities, cases, contracts and documents, with multi-currency and many languages. SuiteCRM 7 is the stable line; SuiteCRM 8 lives in a separate repository and, per the README, is not yet as feature complete.

• Pros: the broadest feature set; runs on Apache, PHP 8.1 to 8.4 and MySQL, MariaDB or SQL Server; commercial hosting and support from SuiteCRM Ltd if you need it.
• Cons: an older interface; the 7-to-8 transition is still under way.

We compare it head to head in Twenty vs SuiteCRM.

EspoCRM: fast, focused and mature

• EspoCRM: CRM with a frontend designed as a single page application, and a REST API.

EspoCRM manages leads, contacts, opportunities, marketing campaigns and support cases in a single-page web app backed by a PHP REST API. It supports MySQL, MariaDB or PostgreSQL and has an online demo.

• Pros: responsive interface; REST API; documented Docker and Traefik installs; steady releases.
• Cons: a smaller community than SuiteCRM; customization beyond the admin screens means building extensions.

Frappe CRM: best if you run ERPNext

• Frappe CRM: Open-source CRM for sales teams with lead and deal pages, kanban pipelines, custom views and unlimited users.

Frappe CRM is a newer CRM from the ERPNext team, built for sales teams with unlimited users. Each lead or deal gets a single page with activities, notes, comments and tasks, alongside kanban boards and custom views. Built-in integrations cover Twilio and Exotel calling, WhatsApp messaging and ERPNext for invoicing and accounting.

• Pros: clean, modern interface; Docker Compose setup; very active (over 3,000 commits in the last year).
• Cons: built on the Frappe framework, so you run Python, MariaDB and Redis.

BottleCRM and Atomic CRM: for builders

• BottleCRM: Multi-tenant Django and SvelteKit CRM with leads, accounts, opportunities, support tickets, invoices and a REST API.
• Atomic CRM: React and Supabase CRM with contacts, tasks, notes, email capture and a kanban deal pipeline.

BottleCRM (MIT) covers leads, accounts, contacts, opportunities, support tickets with SLA timers, and invoices, through a SvelteKit web app, a Flutter mobile app and a REST API. PostgreSQL row-level security isolates each organization, so one install can serve many tenants.

Atomic CRM (MIT) from Marmelab is a React and shadcn/ui CRM on Supabase with contacts, tasks, notes, email capture by CC, a kanban deal pipeline and sign-in via Google, Azure, Keycloak or Auth0. It is designed to be forked and customized, which suits developers more than sales managers.

Other CRMs worth knowing

• Odoo and Dolibarr: CRM modules inside full ERP suites, useful if you want quotes, invoices and stock in the same system.
• OroCRM (OSL-3.0): the Symfony-based community edition of OroCRM.
• Relaticle (AGPL-3.0): a newer Laravel CRM with custom fields, kanban boards, a REST API and an MCP server.
• Corteza (Apache-2.0): a CRM combined with a low-code platform for building other business apps.
• DeskcommCRM and wacrm (MIT): CRMs built around selling over WhatsApp.
• Monica (AGPL-3.0): a personal CRM for friends and family rather than sales. Its default branch is a beta with little recent activity, so use the stable 4.x branch.

Self-hosted CRM vs SaaS: what actually changes

Moving off Salesforce or HubSpot is mostly about cost and control, but a few things work differently when you run the CRM yourself:

• Email and calendar sync. Hosted CRMs connect to Gmail and Microsoft 365 in a couple of clicks. Self-hosted, you configure IMAP, SMTP or OAuth apps yourself, so test email logging early, because it is what salespeople notice first.
• Integrations. SaaS CRMs ship hundreds of connectors. With an open-source CRM you lean on its REST or GraphQL API, webhooks, or an automation tool such as n8n to connect forms, billing and support.
• Marketing automation. Most of these CRMs track campaigns but are not full marketing platforms. Pair them with a newsletter tool such as Mautic or listmonk if you need nurture flows.
• Uptime and backups are yours. Put the CRM behind HTTPS, back up the database daily and keep the app updated. A CRM holds personal data, so data-protection rules apply to you as the operator.

Migrating your data

Every CRM here can import contacts and companies from CSV, which covers most migrations from a hosted CRM's export. Plan the mapping of custom fields and deal stages before you import, move a small test batch first, and keep the old system read-only for a few weeks in case something was missed. Pipelines, owners and activity history are the parts most likely to need manual clean-up.

How to choose

• Small team, wants something modern that can grow: Twenty.
• Needs the broadest feature set, including support cases and contracts: SuiteCRM or EspoCRM.
• PHP shop or cheap shared hosting: Krayin or EspoCRM.
• Already on ERPNext: Frappe CRM.
• Building a CRM product or heavily customized internal tool: Atomic CRM or BottleCRM.
• Replacing a specific product: see our open-source alternatives to Salesforce, HubSpot, Pipedrive and Zoho CRM.

A CRM is rarely the only tool you need. For invoicing and books, see the best open-source accounting software; for support tickets, browse Helpdesk & Ticketing or our Zendesk and Freshdesk alternatives.

"Free POS software" usually means a free trial or a free tier that locks you into one payment processor. The projects below are different: the code is on GitHub, you can run it on your own server or a mini PC behind the counter, and nobody can raise the subscription price on you. We checked every project's repository, licence and documentation, and dropped any that were archived, unlicensed or inactive for more than a year.

The open-source POS systems at a glance

Star and commit figures are GitHub snapshots from early October 2026; each app page shows live numbers.

You can browse every app in the Point of Sale category.

Open Source Point of Sale (OSPOS): the complete free core

• Open Source POS: Open Source Point of Sale is a web based point of sale system.

OSPOS is the long-running default for a reason. It is a web-based POS written in PHP on CodeIgniter 4 with MySQL or MariaDB, and its core already includes stock management with item kits, multi-tier taxes (VAT and GST), a sales register, receipts, quotations and invoices, gift cards, rewards, restaurant tables, SMS messaging and barcode printing. A public demo resets whenever new code lands, so you can try it before installing.

• Pros: everything most shops need is in the free core; an official Docker Compose setup, including an Nginx variant with Let's Encrypt HTTPS; the wiki documents Raspberry Pi installs and supported receipt printers and scanners.
• Cons: the interface is built on Bootstrap 3 and looks dated next to newer tools; the MIT licence adds a condition that the opensourcepos.org footer must stay visible on every page, so you cannot fully white-label it.

NexoPOS: modern and modular

• NexoPOS: Laravel and Vue point-of-sale system with registers, receipts, inventory, procurement, customers and reports, extensible with modules.

NexoPOS is a Laravel, Vue and Tailwind POS for retail stores, restaurants, cafés and warehouses. The core covers products, taxes, registers, payments, refunds, inventory, procurement, customer groups, rewards, coupons and barcode or scale-barcode support, with roles and activity tracking.

• Pros: the most modern interface here; a module system lets you add features without forking; a ready-made NexoPOS for Windows package bundles everything for a single counter PC.
• Cons: restaurant (Gastro), multi-store, booking and several other features are separate modules from the NexoPOS Marketplace, so check what you need before you commit; self-hosting needs scheduled tasks and a queue worker, not just a web server.

Deciding between the two? Read our Open Source POS vs NexoPOS comparison.

Odoo Point of Sale: POS as part of a bigger suite

• Odoo: Free open source ERP system.

Odoo's Point of Sale app and its Restaurant add-on are part of the LGPL-3.0 Community edition, and they share products, stock and customers with Odoo's inventory, sales and website apps. If you want your till, online shop and stock in one system, this is the most polished way to do it.

• Pros: huge ecosystem and partner network; one database for in-store and online sales; official Docker images.
• Cons: several Odoo apps and features are Enterprise-only, so your total cost depends on which modules you end up needing; it is far heavier than a dedicated POS.

ERPNext: POS with a fully open ERP behind it

• ERPNext: ERP system to help you run your business.

ERPNext ships a Point of Sale screen in its GPL-3.0 core, alongside accounting, inventory, manufacturing and purchasing. POS sales feed the same stock and accounting records as the rest of the ERP, and there is no closed edition to upgrade to.

• Pros: the strongest accounting and inventory of any option here; everything is open source; official Docker setup through frappe_docker.
• Cons: you are running a full ERP (Python, MariaDB, Redis) to ring up sales, which is overkill for a single small shop. Older alternative POS front ends for ERPNext, such as POS Awesome and TailPOS, have not been updated in over a year, so we left them out.

If you are weighing the two big suites, see Odoo vs ERPNext.

Dolibarr TakePOS: the easiest all-rounder to host

• Dolibarr: Modern CRM software package to manage your company or foundation activity (contacts, suppliers, invoices, orders, stocks, agenda, accounting, ...).

Dolibarr is a modular PHP ERP and CRM, and its built-in TakePOS module turns it into a point of sale. Because you only switch on the modules you need, it can be a POS plus invoicing, stock and a customer database for a small business.

• Pros: runs on ordinary PHP hosting with MariaDB, MySQL or PostgreSQL; DoliWamp and DoliDeb packages and an official Docker image; over 1,000 add-ons on the Dolistore.
• Cons: the POS is one module in a large suite, so it is less specialised than OSPOS or NexoPOS. See ERPNext vs Dolibarr for how the two ERPs differ.

Lakasir: simple POS with browser printing

• Lakasir: Simple Laravel POS with product and stock management, purchasing, vouchers, receivables, barcode support and USB thermal printing.

Lakasir (from kasir, Indonesian for cashier) is a deliberately simple Laravel and Filament POS. It handles sales, products with unit-based pricing, discounts, purchasing, stock-taking, receivables, vouchers, basic income and expense accounting, and a real-time dashboard.

• Pros: prints to USB thermal printers directly from Chrome or Firefox via WebUSB; barcode support in POS, purchasing and stock-taking; Dockerfile and Compose file in the repo.
• Cons: smaller community and a slower release pace than OSPOS; the README is most of the documentation.

URY: a restaurant POS on ERPNext

• URY: Restaurant management app built on ERPNext with a POS for dine-in, takeaway and delivery, a kitchen display and P&L reports.

URY is a restaurant management app built on ERPNext. Its POS handles dine-in, takeaway and delivery with an offline mode and printer management, URY Mosaic adds a kitchen display system, and the analytics include a P&L dashboard.

• Pros: the only restaurant-first option here, with kitchen display and order routing included under AGPL-3.0.
• Cons: it needs an ERPNext site underneath; the README warns that it is in active development and backward compatibility may break before a stable release (the latest tag is a 3.0 beta).

For more restaurant options, see our Toast alternatives.

What "free" POS software still costs

Open-source POS removes the software subscription, not every cost:

• Hardware: a PC, tablet or mini PC at the till, a receipt printer, a barcode scanner and a cash drawer. Most of these systems run in a browser, so existing hardware often works.
• Card payments: you still need a payment processor or terminal. Hosted systems such as Square bundle this; with self-hosted POS you choose your own provider.
• Hosting and backups: a small VPS or an on-site server, plus a backup routine. Sales data is your business record, so test restores.

How to choose

• One shop, want it working this week: Open Source POS. Its official Docker setup is the quickest route to a working till.
• Want a modern UI and may grow into more stores or a restaurant: NexoPOS, budgeting for the modules you need.
• POS is part of running the whole business (stock, purchasing, accounting): ERPNext if you want everything open source, Odoo if you value its ecosystem, Dolibarr if you want the lightest suite to host.
• Restaurant: URY on ERPNext, or Odoo's Restaurant add-on.
• Replacing a specific product: see our open-source alternatives to Square POS, Shopify POS, Lightspeed and Toast.

Once sales are flowing, you will want proper books too. Our guide to the best open-source accounting software covers that side.

Projects we checked and left out

We only list maintained, properly licensed software. Store-POS has no licence file, so nothing grants you the right to use or modify it. TailPOS (last updated 2022) and POS Awesome (last updated August 2024) are inactive. Both may still work, but we would not start a new shop on them.

Here is how the four options compare, and which one to buy for which job.

The comparison at a glance

Intel N100 and N150: the quiet default

The Intel N100 and its slightly faster refresh, the N150, are the processors inside most budget mini PCs from Beelink, GMKtec, Minisforum and others. Four efficiency cores are enough for Docker hosts running a dozen web apps, a database or two, Home Assistant and a media server.

The standout feature is the GPU. These chips use the same Intel Quick Sync generation as 12th-gen Core processors, which decodes HEVC 10-bit and AV1 in hardware. For a Jellyfin or Plex server that matters more than raw CPU speed; our home server for Plex and Jellyfin guide goes deeper.

The weak points are memory and expansion. Most N100/N150 boxes have a single RAM slot (often capped at 16 GB) and one or two M.2 slots. They are a poor fit for many virtual machines or for local AI models. Prices also moved a lot in 2026: Jeff Geerling noted in January that a 16 GB/512 GB GMKtec N100 had risen to $246.99 from $159 a year earlier, and some N150 listings were above $380 by September. Compare a few brands before buying.

Buy one if you want a new, silent, warrantied box for Docker and media.

Used ThinkCentre, OptiPlex and EliteDesk: the best value

One-litre business PCs coming off corporate leases are the self-hosting community's favourite hardware, and for good reason. A Lenovo ThinkCentre M720q or M920q, Dell OptiPlex 7070 Micro or HP EliteDesk 800 G4/G5 Mini typically has a 6-core Intel Core i5 "T" CPU, two RAM slots, an NVMe slot plus a 2.5-inch bay, and Quick Sync. Recent eBay sales of the M720q ranged from about $180 (i5-8500T, 8 GB) to about $260 (i5-9400T, 16 GB).

Compared with an N100, you get more cores, more RAM headroom and more storage options for similar money. The trade-offs: an older Quick Sync generation without AV1 decode, no warranty, and a fan that is audible under load. Some ThinkCentre Tiny models even take a PCIe card through a riser for a faster network adapter.

Buy one if you want the most capability per dollar, plan to run Immich with machine learning, or want to try Proxmox with several VMs.

Mac mini: powerful, efficient and a little awkward

Apple launched an M6 Mac mini in August 2026 starting at $899 with 16 GB and 256 GB, $300 more than the M4 model's original $599 entry price. It is fast, tiny and very efficient at idle.

The problem for self-hosting is the operating system. Docker on macOS runs containers inside a Linux virtual machine, so host networking, device passthrough (for Zigbee sticks or a Coral accelerator) and some file-permission setups behave differently from a Linux server. Memory and storage cannot be upgraded later.

Where the Mac mini shines is local AI: unified memory lets Ollama run larger models than an N100 can. If that is your main goal, it is a serious option; see our Ollama deploy guide.

Buy one if local LLMs are the point, or you already own an Apple Silicon Mac mini and want to put it to work.

Raspberry Pi 5: still lovely, no longer cheap

The Pi 5 remains a capable little Linux computer: a quad-core Cortex-A76 at 2.4 GHz, PCIe for an NVMe drive through an M.2 HAT, and a bare-board idle draw around 3 W. Most popular self-hosted apps publish ARM64 images.

But the price has changed. Raspberry Pi raised prices three times between December 2025 and April 2026 as LPDDR4 memory costs rose, and the official prices are now $175 for 8 GB and $305 for 16 GB, before a case, the 27 W power supply and storage. It also has no hardware video encoder, and Jellyfin has deprecated hardware acceleration on the Pi.

Buy one if you want a dedicated, ultra-low-power box for DNS, Home Assistant or a handful of light apps. Our list of 15 apps that run well on a Pi 5 shows what fits.

Which one should you buy?

• First home server, best value: used ThinkCentre Tiny, OptiPlex Micro or EliteDesk Mini with 16 GB.
• Silent, new, media-focused: Intel N150 mini PC with 16 GB and dual network ports.
• Security cameras with Frigate: an Intel box with Quick Sync, so video decoding stays off the CPU.
• Local AI: Mac mini, or a desktop with a discrete GPU.
• Always-on DNS and smart home only: Raspberry Pi 5 with 8 GB.

• Jellyfin: Media server for audio, video, books, comics, and photos with a sleek interface and robust transcoding capabilities. Almost all modern platforms have clients, including Roku, Android TV, iOS, and…
• Immich: Photo and video backup solution directly from your mobile phone (alternative to Google Photos).
• Home Assistant: Home automation platform.

Storage and the rest of the bill

Budget for a 1 to 2 TB NVMe SSD for apps and databases. Mini PCs fit one or two drives, so bulk media usually ends up on a USB enclosure or a NAS. Add a plug-in power meter, and plan an off-site backup from day one.

If you want a web interface for managing containers on whichever box you choose, Portainer and the other self-hosting platforms make it point-and-click. For the full plan from hardware to backups, read homelab for beginners and our self-hosting roadmap.

How we ranked them

Popularity lists go stale fast because stars accumulate forever, even on projects nobody maintains. So we used activity as a gate and stars as the order:

1. Actively developed: at least 500 commits to the default branch in the last 12 months. 492 apps in the catalog pass this bar.
2. Easy to self-host: an official Docker image, and not archived.
3. Open source: an OSI-style licence as reported by GitHub. That excludes fair-code and source-available projects such as n8n and NocoDB.
4. An app, not a building block: we left out databases, search engines and backend frameworks (Supabase, PocketBase, Appwrite) that you build on rather than use.

Then we sorted the shortlist by stars. The figures are a snapshot taken on October 6, 2026; every app page on appsgit shows the live numbers.

The ranking

Together these 25 projects landed more than 107,000 commits in a year. The busiest by far is Home Assistant with 17,497, followed by Grafana and Odoo, each above 10,000.

What the data says about self-hosting in 2026

AI is the new home-lab default. Seven of the top 13 are AI tools. Ollama runs open-weight models locally, Open WebUI gives them a ChatGPT-style interface, and Dify, Langflow, RAGFlow and AnythingLLM turn them into agents and document chat. If you want a private replacement for paid chat assistants, see our ChatGPT alternatives.

• Ollama: Get up and running with Llama 3.3, DeepSeek-R1, Phi-4, Gemma 3, and other large language models.
• Open-WebUI: User-friendly AI Interface, supports Ollama, OpenAI API.

The classics are still growing. Immich is the most-starred non-AI app on the list and the clearest example of a self-hosted project beating a big-tech product on features. Jellyfin, Home Assistant and Uptime Kuma remain the first apps most people install.

Licences deserve a second look. "Open source" on a GitHub badge is not always the full story. Dify's licence is Apache 2.0 with extra conditions that forbid running it as a multi-tenant service and removing its logo. Open WebUI added a branding clause to its BSD-3 licence in 2025. Netdata's agent is GPL-3.0, but its dashboard UI ships under a separate non-open licence. None of that matters for a personal server, but it matters if you plan to resell hosting.

The best pick in each category

If you only want one app per need, these are the ones we would install first:

• Photos: Immich. Automatic phone backup, face recognition and a polished mobile app. Our Immich deploy guide gets it running in about 15 minutes.
• Media: Jellyfin. Free hardware transcoding and no account required. Read Jellyfin vs Plex if you are deciding.
• Monitoring: Uptime Kuma for simple up/down checks and status pages, Grafana plus Prometheus when you need metrics.
• Smart home: Home Assistant, the most actively developed project in the whole catalog.
• Deploying everything else: Coolify gives you a Heroku-style dashboard on your own VPS, and Traefik routes traffic with automatic HTTPS.
• Work tools: Plane for issues and roadmaps, Twenty as a CRM, Gitea for Git hosting and Penpot for design.

• Home Assistant: Home automation platform.

Honourable mentions

A few hugely popular projects missed the cut on our rules, not on quality:

• n8n has more stars than any app in the table, but its Sustainable Use License is fair-code rather than OSI open source. It is still free to self-host for internal use; see n8n vs Zapier vs Activepieces.
• Vaultwarden is the password server most self-hosters run, but it is a small, stable codebase with 181 commits in the past year. Low churn is a feature for security software. Our Vaultwarden vs Bitwarden comparison explains the trade-offs.
• Syncthing and Caddy fall under the activity gate for the same reason: mature, focused tools that do not need thousands of commits a year.

How to use this list

Pick one app that solves a real problem for you, deploy it with Docker Compose, put it behind a reverse proxy and set up backups before you add a second. If you are starting from zero, our beginner's self-hosting roadmap covers hardware, Docker, HTTPS and backups in order. When you are ready for more, browse all apps sorted by stars or by recent activity.

Install Docker Compose

Compose today is a plugin for the Docker CLI, used as docker compose (with a space). The older standalone docker-compose binary (with a hyphen) is legacy.

• Linux: install Docker Engine from Docker's official repository for your distribution and include the docker-compose-plugin package. Your distribution's own docker.io package is often older.
• Windows and macOS: Docker Desktop includes Compose.

Confirm it works:

docker compose version

Add your user to the docker group if you want to run commands without sudo, and remember that membership in that group is effectively root access. Our self-hosting roadmap covers preparing a fresh server.

Your first compose.yaml

Create one folder per app. Everything the app needs lives inside it, which makes backups and migrations simple.

services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    container_name: uptime-kuma
    restart: unless-stopped
    ports:
      - "127.0.0.1:3001:3001"
    volumes:
      - ./data:/app/data

Run docker compose up -d in that folder. The parts:

• services lists containers. The key (uptime-kuma) is the service name, which also becomes its hostname on the project's network.
• image is what to run. Pin at least the major version (:2) instead of latest, so a breaking release never arrives by surprise.
• ports maps host port to container port. Prefixing 127.0.0.1: keeps the app reachable only from the server itself, ready for a reverse proxy.
• volumes keeps data outside the container, so you can delete and recreate the container without losing anything.

This is the same setup our Uptime Kuma deploy guide builds on.

A note on file names: Compose accepts compose.yaml (preferred) and docker-compose.yml. You may still see a version: "3.8" line at the top of older examples; it is obsolete and can be deleted.

The .env file: settings and secrets

Compose automatically reads a file named .env in the project folder and substitutes its values into compose.yaml wherever you write ${NAME}. This is how most projects separate configuration from the file itself.

# .env
APP_VERSION=v3
UPLOAD_LOCATION=/srv/photos
DB_PASSWORD=change-me-to-a-long-random-string

services:
  server:
    image: ghcr.io/example/server:${APP_VERSION:-latest}
    volumes:
      - ${UPLOAD_LOCATION}:/data
    environment:
      DB_PASSWORD: ${DB_PASSWORD}

Two related features are easy to confuse:

Run docker compose config to print the final file with every variable resolved; it is the fastest way to debug a typo. Immich ships its official setup as a Compose file plus an .env file for the upload location, database password and version, so the Immich deploy guide is a good real-world example.

Treat .env as a secret. Restrict it with chmod 600 .env, never commit it to Git, and generate passwords with openssl rand -base64 32.

Volumes: where your data lives

Containers are disposable; volumes are not. Compose offers two kinds:

• Bind mounts (./data:/app/data) map a host folder into the container. You can see and back up the files directly. Most self-hosters prefer them.
• Named volumes (db_data:/var/lib/postgresql/data plus a top-level volumes: entry) are managed by Docker under /var/lib/docker/volumes. They avoid some permission issues and are common for databases.

Add :ro to mount something read-only, for example a media library that the app should never modify. Whichever you choose, the rule is the same: anything not in a volume is lost when the container is recreated.

Networks: how containers talk

Every Compose project gets its own default network, and services reach each other by service name. A web app connects to its database at db:5432, not at an IP address, and the database needs no published port at all.

services:
  webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    depends_on:
      db:
        condition: service_healthy
    environment:
      PAPERLESS_DBHOST: db
  db:
    image: postgres:16-alpine
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U paperless"]
      interval: 10s
      retries: 5

depends_on with condition: service_healthy makes the app wait until the database actually accepts connections, which avoids a common first-start crash. Paperless-ngx runs this way with Postgres and a Redis-compatible broker; see the Paperless-ngx guide, and the Gitea guide for a Git server with Postgres.

Sharing a reverse proxy across projects. Create one network once (docker network create proxy), declare it as external: true in each project, and attach both the proxy and each web app to it. Traefik then discovers containers from their labels; the Traefik guide walks through it, and the Caddy guide shows the simpler file-based approach. If you are choosing, read Caddy vs Traefik.

A firewall warning. Ports you publish with Docker are opened through Docker's own iptables rules, which bypass UFW on Ubuntu. Publish only what must be public (normally just the proxy on 80 and 443) and bind everything else to 127.0.0.1.

Restart policies

Everyday commands

docker compose up -d          # create or update and start in the background
docker compose ps             # status of this project's containers
docker compose logs -f app    # follow one service's logs
docker compose exec app sh    # open a shell inside a running container
docker compose down           # stop and remove containers (volumes stay)

docker compose down -v also deletes named volumes. Do not type it on a project whose data you want to keep.

Updating safely

1. Read the release notes for breaking changes, especially major versions.
2. Back up first (see below).
3. Run docker compose pull, then docker compose up -d. Compose recreates only containers whose image changed.
4. Clean old images occasionally with docker image prune.

Fully automatic updaters are convenient, but for apps that hold data, a notification that an update exists is safer than an unattended upgrade.

Backing up a Compose project

Because each app lives in one folder, backups are straightforward:

• Files: back up the project folder: compose.yaml, .env and every bind-mounted data folder.
• Databases: do not copy a live database's files. Dump it instead, for example docker compose exec -T db pg_dump -U app app > backup.sql, or stop the stack before copying.
• Off-site: send it all to another location with an encrypted, deduplicating tool such as Restic or Kopia, and test a restore regularly.

Prefer a web UI?

Dockge manages Compose stacks from a browser while keeping the files on disk, and Portainer adds broader container management. Our Portainer vs Dockge comparison helps you choose.

• Dockge: Fancy, easy-to-use manager for Docker compose stacks from the creator of Uptime Kuma.
• Portainer: Web UI for managing Docker, Swarm and Kubernetes environments.

Every deploy guide on appsgit uses the patterns above. Pick an app from the 25 best self-hosted apps in 2026, make a folder, and write your next compose.yaml.

Plex or Jellyfin first

The hardware is the same for both, but the costs are not. On Plex, hardware transcoding and remote streaming require a Plex Pass ($6.99 a month, $69.99 a year or $749.99 lifetime for new buyers, as of October 2026). Jellyfin is free and open source (GPL-2.0) and includes hardware transcoding and remote access at no cost. Our Jellyfin vs Plex comparison covers the trade-offs in depth; the rest of this guide applies to either.

• Jellyfin: Media server for audio, video, books, comics, and photos with a sleek interface and robust transcoding capabilities. Almost all modern platforms have clients, including Roku, Android TV, iOS, and…

Why hardware transcoding decides your CPU

Transcoding converts a video on the fly when a device cannot play the original file, or when the connection is too slow for the original bitrate. Doing it in software takes most of a CPU's power for a single 4K stream. Doing it with a dedicated video engine costs a few watts.

Which Intel generation? Newer is better, because each generation adds codecs. The N100 and N150 use the same graphics generation as 12th-gen Core chips, which decode HEVC 10-bit and AV1 in hardware and handle HDR-to-SDR tone mapping on the GPU in Jellyfin. Older 8th to 10th-generation chips in used office PCs still handle H.264 and HEVC well, but they lack AV1 decoding. Jellyfin's documentation notes that older Jasper Lake and Elkhart Lake Celerons have no AV1 support and advises buying newer hardware when shopping.

The best transcode is no transcode. If your TVs and streaming sticks can direct-play your files, the server only reads from disk. Transcoding mostly happens for remote viewers, browsers, subtitles that need burning in, and 4K HDR files on non-HDR screens.

Passing the GPU into a container

In Docker, give the container access to the Intel GPU device. A minimal Jellyfin service looks like this:

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    restart: unless-stopped
    ports:
      - "8096:8096"
    devices:
      - /dev/dri:/dev/dri
    volumes:
      - ./config:/config
      - ./cache:/cache
      - /srv/data/media:/data/media:ro

Then enable Intel QSV (or VA-API) in Jellyfin's playback settings. The Jellyfin deploy guide covers permissions and the render group. If Compose is new to you, read our Docker Compose tutorial first.

Storage: plan it before you buy drives

Media libraries grow faster than anything else on a home server. A sensible layout:

• SSD for the operating system, Docker and app data. Media server metadata, thumbnails and databases are many small files and are much faster on flash.
• Hard drives for media. Large CMR drives give the best cost per terabyte. Two or more drives can be pooled with a tool like mergerfs, protected with SnapRAID or ZFS, or handed to a NAS.
• One /data folder for downloads and media. Put downloads and the finished library on the same file system, and mount that single parent folder into every container. That lets the *arr apps use hardlinks and instant moves instead of copying files.

Remember that RAID or parity is not a backup. At minimum, back up each app's configuration folder; re-downloading a film is annoying, rebuilding years of watch history and metadata is worse.

A small mini PC has room for one or two drives, so bulk storage usually lives in a USB enclosure or a NAS. For the mini PC itself, see our best mini PC for a home server comparison.

The apps around the media server

The "*arr stack" is a family of open-source apps that watch for new releases, fetch them through your download client, rename them and place them in your library. Use them with content you have the right to download.

Star counts are from the appsgit catalog on October 6, 2026.

Seerr deserves a note. Jellyseerr and Overseerr, the two popular request apps, merged into a single project called Seerr. It works with Jellyfin, Plex and Emby, imports your media server users, and lets them request a film or series that Sonarr or Radarr then fetch. If you previously ran Jellyseerr, Seerr is where development continues.

• Sonarr: Automatic TV Shows downloader and manager for Usenet and BitTorrent. It can grab, sort and rename new episodes and automatically upgrade the quality of files already downloaded when a better quality…
• Radarr: Automatically download movies via Usenet and BitTorrent (fork of Sonarr).
• Seerr: Manage requests for your media library, supports Plex, Jellyfin and Emby media servers (fork of Overseerr).

The whole category is listed under media management, and media servers themselves under media servers.

Beyond films and TV

The same box can serve music and books with almost no extra load. Navidrome streams your music collection to Subsonic-compatible apps; our Navidrome guide sets it up. Audiobookshelf handles audiobooks and podcasts with progress sync across devices. If you are weighing Navidrome against Jellyfin's built-in music support, see Navidrome vs Jellyfin.

Remote access without opening everything

Remote viewing is where most media servers get exposed carelessly. Put Jellyfin behind a reverse proxy with HTTPS, such as Caddy or Nginx Proxy Manager, and keep the *arr apps, the download client and Seerr's admin pages on your LAN or a VPN. The *arr apps were not designed to face the open internet.

Power, noise and uptime

A media server is on all day, so idle power matters more than peak speed. Intel mini PCs idle at a few watts plus whatever your hard drives draw; spinning disks add noise and power, so let the system and apps live on the SSD and allow the media drives to spin down when nobody is watching. If power cuts are common where you live, a small UPS protects the drives and the database files of your *arr apps from corruption.

A sample build

• CPU and box: Intel N150 mini PC or a used ThinkCentre Tiny with an 8th-gen or newer Core i5.
• RAM: 16 GB.
• System drive: 1 TB NVMe SSD.
• Media: two large hard drives in a USB-C or network enclosure, or a NAS.
• Software: Ubuntu Server or Debian, Docker Compose, Jellyfin or Plex, Sonarr, Radarr, Prowlarr, Seerr and a download client.

For everything else a first server should run, read homelab for beginners.

The rest of this guide explains each choice and the traps that waste money in a first homelab.

What a homelab is, and what it is for

A homelab is hardware at home that you control and are free to break. Most people build one for two reasons: to replace paid cloud services (photo storage, password managers, streaming) and to learn Linux, networking and containers. Both goals point to the same first step: one reliable machine that is on all the time, sips power and runs containers well.

If you have never self-hosted anything, read our step-by-step self-hosting roadmap alongside this article. It covers installing Docker, adding HTTPS and setting up backups in detail; this post focuses on the hardware and the plan.

What to buy: the four realistic options

Used office mini PCs are the default recommendation. Corporate leasing cycles dump thousands of one-litre machines with 8th to 10th-generation Intel Core CPUs onto the used market. They have real x86 performance, two RAM slots, an NVMe slot and Intel Quick Sync for video. Recent eBay sales of a Lenovo ThinkCentre M720q ranged from about $180 for an i5-8500T with 8 GB to about $260 for an i5-9400T with 16 GB.

The Raspberry Pi 5 is no longer the cheap option. Memory shortages driven by AI data centres forced Raspberry Pi to raise prices three times between December 2025 and April 2026, and the 16 GB board now lists for $305, more than many complete x86 mini PCs. A Pi 5 is still excellent for a dedicated ad blocker or a few light services; see our list of apps that run well on a Raspberry Pi 5.

A NAS is optional at the start. A Synology or a home-built NAS makes sense once you have terabytes of photos or films. Until then, one large SSD or hard drive inside the mini PC plus an off-site backup is simpler. When you outgrow it, add a NAS for storage and keep the mini PC for compute.

Power draw: the running cost nobody budgets for

A homelab runs 24 hours a day, so idle power matters more than peak performance. The arithmetic is simple: a machine that idles at 10 W uses about 88 kWh a year (10 W x 8,760 hours). At an illustrative $0.17 per kWh that is about $15 a year. An old tower drawing 60 W at idle uses six times as much, and a retired rack server can draw far more than that.

Three rules keep the bill small:

• Prefer laptop-class or "T" CPUs (35 W TDP) over desktop chips.
• Use SSDs for the system and apps; spin up hard drives only for bulk media.
• Measure with a plug-in power meter instead of trusting spec sheets.

Proxmox or plain Docker?

This is the first big decision, and beginners often overthink it.

Choose plain Docker if your goal is to run self-hosted apps. Every app in our catalog ships a Docker image or Compose file, and our Docker Compose tutorial for self-hosters shows the patterns you will use for every one of them.

Choose Proxmox if learning virtualization is the point, or you want to run Home Assistant OS, a firewall such as OPNsense, or a Windows VM next to your containers. Proxmox snapshots also make experiments safer. You lose nothing by starting with Docker: you can later install Proxmox and move your Compose folders into a VM unchanged.

If you want a web UI for your containers either way, Portainer is the full-featured option and Dockge is a lighter one that keeps your Compose files on disk. Our Portainer vs Dockge comparison explains the trade-offs, and the self-hosting platforms category lists more.

The first five apps to run

Run these in order. Each one teaches a skill that the next one depends on.

1. A network ad blocker: Pi-hole or AdGuard Home. Point your router's DNS at it and every device on the network loses ads and trackers. It teaches you ports, DNS and static IPs. See the Pi-hole deploy guide and Pi-hole vs AdGuard Home.
2. Uptime Kuma for monitoring. It tells you when something breaks, which you will need from now on. Our Uptime Kuma guide takes about ten minutes.
3. A dashboard: Homepage. One start page for every service, with live status widgets. It is also good practice at editing YAML.
4. Vaultwarden for passwords. A Bitwarden-compatible server in one small container. Only install it after you have HTTPS and backups; follow the Vaultwarden guide.
5. Immich for photos. Automatic phone backup with face search and a polished mobile app. It needs at least 6 GB of RAM according to its own documentation, so plan for 8 to 16 GB in the machine. The Immich guide covers the setup.

• Pi-hole: Blackhole for Internet advertisements with a GUI for management and monitoring.
• Uptime Kuma: Easy-to-use self-hosted uptime monitor with status pages and 90+ notification channels.
• Vaultwarden: Lightweight Bitwarden server API implementation written in Rust.
• Immich: Photo and video backup solution directly from your mobile phone (alternative to Google Photos).

Before step four, set up backups. Restic with an off-site bucket is a common choice; the rule is three copies of your data, on two kinds of media, with one copy off-site.

What to skip in your first homelab

• Rack servers and enterprise gear. Cheap to buy used, expensive and loud to run. A single retired 2U server can cost more in electricity each year than a new mini PC.
• 10-gigabit networking. Gigabit or 2.5-gigabit is plenty until you edit video over the network.
• Kubernetes on day one. It is worth learning eventually, but it multiplies the moving parts. Get comfortable with Compose first.
• Exposing everything to the internet. Publish only what other people need through a reverse proxy, and reach admin tools over a VPN such as Tailscale or Headscale.
• Buying for a hypothetical future. A homelab is easy to upgrade. Start small, measure what you use, then spend.

Where to go next

Once the first five apps are stable, add one service at a time: media with Jellyfin (our Plex and Jellyfin hardware guide covers transcoding), documents with Paperless-ngx, or smart home control with Home Assistant. For ideas ranked by real GitHub activity, see the 25 best self-hosted apps in 2026.

Step 1: Pick the type of site

Default to static if you are comfortable writing in Markdown. There is no database, no login page and no PHP to patch, and the whole site is a folder you can copy anywhere. Most "self hosted site" projects that people abandon are dynamic sites that nobody updates.

Step 2: Choose where it runs

A VPS is the right home for most public websites. You get a public IP, symmetrical bandwidth, a data-centre power supply and no conversation with your ISP. A 1 to 2 GB instance runs a static site or a small WordPress or Ghost blog; Ghost's own Docker documentation uses a 2 GB, 1 CPU server as its example.

A home server works well for personal sites and costs nothing extra if it is already running. Check:

• Public IP. Many ISPs use CGNAT, which means you cannot accept incoming connections. A tunnel solves this: Pangolin is a self-hosted, open-source tunnelled reverse proxy that runs on a cheap VPS and forwards traffic to your home, and Cloudflare Tunnel is a hosted alternative.
• Terms of service. Some residential plans forbid servers.
• Uptime. Power cuts and router reboots take your site down. For a hobby site that is fine; for a business it usually is not.

A useful hybrid: build at home, publish static files to a VPS.

Step 3: Sort out the domain and DNS

Every option below assumes you own a domain. Register one with any registrar that offers plain DNS management, then create:

• An A record (and an AAAA record if you have IPv6) pointing the domain, or a subdomain such as blog.example.com, at your server's public IP.
• A www record if you want both forms to work; let the web server redirect one to the other.

At home, your public IP may change. Most routers support dynamic DNS, and several DNS providers offer an API that a small container can update automatically. If you use a tunnel, the tunnel provider handles this for you.

Do not plan to send email from the same home server. Residential IPs are widely blocked by mail providers, so contact forms and newsletters should go through a transactional email service even when the site itself is self-hosted.

Choosing a static site generator

If you go static, the generator matters more than the server. Hugo is a single binary and builds very large sites quickly. Astro suits people who know JavaScript and want components. Eleventy is minimal and flexible. All of them take Markdown files and a theme, and all of them produce a folder of plain HTML that any web server, including the setups below, can serve. Pick the one whose themes and documentation you like; switching later is mostly a matter of moving Markdown files.

Option A: a static site with Caddy

Caddy serves files and handles HTTPS with almost no configuration. Build your site into a public folder, then run:

services:
  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./public:/srv:ro
      - caddy_data:/data
      - caddy_config:/config

volumes:
  caddy_data:
  caddy_config:

With a Caddyfile of three lines:

example.com {
    root * /srv
    file_server
}

Point your domain's DNS at the server, start the stack, and Caddy requests a certificate from Let's Encrypt or ZeroSSL on its own. Keep the caddy_data volume: it holds your certificates. Our Caddy deploy guide covers compression, headers and redirects, and Caddy vs Nginx explains when Nginx is the better choice. For a single-purpose binary, Static Web Server is another lightweight option, usually behind a proxy.

• Caddy: Powerful, enterprise-ready, open source web server with automatic HTTPS.

To publish updates, rebuild locally and sync the folder with rsync, or push to a Git repository and let a CI job do it.

Option B: WordPress in Docker

WordPress still powers a huge share of the web, and the official Docker image makes it straightforward to run. A typical stack is WordPress (PHP and Apache in one image) plus a MySQL or MariaDB database, behind a reverse proxy for HTTPS. Our WordPress deploy guide gives a complete Compose file with MySQL 8.4 and the secrets kept in an .env file.

Security is mostly about discipline:

• Update WordPress core, themes and plugins promptly, and install as few plugins as possible.
• Never expose the database port; keep it on an internal Docker network.
• Use strong admin passwords and two-factor authentication.
• Back up both the wp-content folder and a database dump, not just one of them.

Option C: Ghost for blogs and newsletters

Ghost is a modern publishing platform with an excellent editor, built-in newsletters and paid memberships. It is MIT-licensed and one of the most active projects in the catalog, with 5,329 commits in the last 12 months.

Ghost now ships an official Docker setup, TryGhost/ghost-docker, that runs Ghost, Caddy and MySQL together, with optional ActivityPub federation and Tinybird-based analytics. Ghost describes it as a preview of its new self-hosting tooling, so read the release notes before upgrading. Sending newsletters needs a transactional email provider such as Mailgun.

Torn between the two? Our Ghost vs WordPress comparison goes through editing, plugins, performance and cost.

• WordPress: World's most-used blogging and CMS engine.
• Ghost: Just a blogging platform.

Add analytics and monitoring

Skip Google Analytics and run your own privacy-friendly analytics:

• Umami is MIT-licensed, light and easy to deploy. See the Umami guide.
• Plausible Analytics offers a polished dashboard; see the Plausible guide.

Plausible vs Umami compares them directly. Then point Uptime Kuma at your site so you hear about an outage before your readers do.

Keep it fast and safe

• Expose only ports 80 and 443. Everything else stays behind the proxy or on a VPN.
• Pin major image versions and update deliberately: docker compose pull && docker compose up -d.
• Put a CDN in front only if you need it; a static site on Caddy is already fast.
• Back up content, databases and the reverse proxy's certificate volume nightly, with one copy off-site.

If you are new to running servers, start with our beginner's self-hosting roadmap, and browse the web servers, CMS and blogging categories for more options.

Step 1: Choose your hardware

There are three good starting points, and you can mix them later.

• An old laptop or desktop. Free, and fine for learning. Laptops even come with a built-in battery backup. Expect higher power draw from older desktops.
• A mini PC. The sweet spot for a home server. Machines built on Intel's N100 (a 6 W processor) idle at a few watts, include Quick Sync for video transcoding and take 16 GB of RAM, which is plenty for a dozen apps. Add an SSD for the system and larger disks for media and photos.
• A VPS. A small cloud server from providers such as Hetzner or DigitalOcean starts at a few dollars a month. It has a public IP and fast upload, which makes it ideal for websites, monitoring and anything that friends need to reach. It is less ideal for terabytes of photos and films.

A note on Raspberry Pi: the Pi 5 is still a capable little server, but memory shortages pushed its prices up sharply through 2026, and an 8 GB or 16 GB Pi now costs about the same as a used x86 mini PC that is faster and easier to expand.

Rule of thumb for RAM: 4 GB runs a handful of light apps, 8 GB runs most home labs, and 16 GB leaves room for photo libraries with machine learning, such as Immich, or local AI.

Step 2: Install Linux and Docker

Install a long-term-support server distribution: a current Ubuntu Server LTS release or Debian 13 are the safest choices because nearly every guide assumes them. Create a normal user with sudo, enable SSH key login, disable password login, and turn on automatic security updates.

Then install Docker Engine with the Compose plugin from Docker's official apt repository, following the steps in Docker's documentation. Docker's get.docker.com convenience script also works, but Docker itself recommends it only for testing. When you are done, this should print a version:

docker compose version

Why Docker? Every app ships as a container image with its dependencies included, and Docker Compose describes the whole app in one readable file. Upgrading becomes "pull the new image and restart", and removing an app leaves nothing behind.

Step 3: Run your first app

Uptime Kuma is an ideal first app: useful from day one, light on resources, and harmless if something goes wrong. Create a folder and a compose.yaml file:

services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    container_name: uptime-kuma
    restart: unless-stopped
    ports:
      - "127.0.0.1:3001:3001"
    volumes:
      - ./data:/app/data

Run docker compose up -d, and the app is listening on port 3001. Binding to 127.0.0.1 keeps it private until the reverse proxy is in place. Notice the ./data folder: that is where all of the app's state lives, and it is what you will back up. Our Uptime Kuma deploy guide covers notifications and status pages.

• Uptime Kuma: Easy-to-use self-hosted uptime monitor with status pages and 90+ notification channels.

If you prefer clicking to editing YAML, Dockge gives you a clean web UI for managing Compose stacks without hiding the files.

Step 4: Add a reverse proxy and HTTPS

A reverse proxy is the single front door to your server. It listens on ports 80 and 443, terminates HTTPS, and forwards each domain to the right container. Only the proxy is exposed; your apps stay on internal ports.

You have three popular options:

• Caddy gets and renews certificates from Let's Encrypt or ZeroSSL automatically, and redirects HTTP to HTTPS by default. A complete config for the app above is two lines:

status.example.com {
    reverse_proxy localhost:3001
}

• Nginx Proxy Manager does the same through a web interface, which many beginners prefer. See our Nginx Proxy Manager guide.
• Traefik discovers containers through Docker labels. It has a steeper learning curve and pays off once you run many apps.

Point a DNS record for each subdomain at your server's public IP. At home, forward ports 80 and 443 on your router to the server, and nothing else.

Step 5: Reach it remotely, safely

Not every app should be on the public internet. Admin panels, Docker dashboards and your file server are better kept on a private network. Tailscale builds an encrypted WireGuard mesh between your devices in minutes, and its free Personal plan covers up to six users with unlimited devices. If you want to run the coordination server yourself too, Headscale is an open-source implementation of it.

A good default: publish only what other people need through the reverse proxy, and reach everything else over the VPN.

Step 6: Back up before you trust it

Backups are the step beginners skip and regret. Follow the 3-2-1 rule: three copies of your data, on two different media, with one copy off-site.

For a Docker server, back up each app's data folders and a dump of each database. Do not copy a running database's files and hope; use the app's export command or stop the container first. Then use a deduplicating, encrypted backup tool:

• restic: Fast, secure and efficient backup program with encryption and deduplication.
• Kopia: Cross-platform backup tool with encryption, deduplication and a web UI.
• BorgBackup: Deduplicating backup program with compression and authenticated encryption.

Restic and Kopia can send encrypted backups straight to S3-compatible storage such as Backblaze B2, and BorgBackup is excellent with a second machine or a storage box. Schedule them nightly, and once a month actually restore something to prove the backup works.

Step 7: Keep it healthy

• Update regularly. Read release notes, then docker compose pull && docker compose up -d. Pin major versions in your image tags so upgrades happen when you choose.
• Watch it. Point Uptime Kuma at every service, and add Beszel for lightweight CPU, memory and disk monitoring.
• Make it pleasant. A dashboard such as Homepage gives you one start page with live status for every app.

What to self-host next

Once backups are running, replace one subscription at a time. The most rewarding next steps are Immich for phone photo backup, Vaultwarden for passwords, Jellyfin for media and Pi-hole for network-wide ad blocking. Our ranking of the 25 best self-hosted apps in 2026 has more ideas, every deploy guide follows the same structure as this roadmap, and the self-hosting platforms category lists tools that automate much of it.

The quick comparison

Immich: the closest thing to Google Photos

Immich started as a direct Google Photos replacement and still feels like one. The mobile apps back up your camera roll in the background, the timeline scrolls smoothly through tens of thousands of photos, and features such as shared albums, partner sharing, a map view, memories and duplicate detection are all built in. Machine learning runs in a separate container and powers face clustering and CLIP-based search, so typing "dog on a beach" works the way you expect.

• Immich: Photo and video backup solution directly from your mobile phone (alternative to Google Photos).

The project is developed with the backing of FUTO, reached its first stable release, 2.0, on October 1, 2025, and has kept up a fast pace since, with version 3.2.4 out in late September 2026 and 2,638 commits in the last year. Immich is completely free. An optional supporter licence, priced at $24.99 per user or $99.99 per server when it launched, funds development without unlocking anything.

Immich asks the most of your hardware: 6 GB of RAM at minimum, 8 GB recommended, and its Postgres database must sit on local storage, not a network share. Your photo library itself can live on a NAS. Our Immich deploy guide gets the official Docker Compose stack running in about 15 minutes.

PhotoPrism: the archivist's choice

PhotoPrism is a mature, browser-first photo manager built in Go. It indexes folders you already have, reads metadata thoroughly, recognises faces, classifies images and places them on a world map. It is excellent at turning a decade of folders into a searchable library, and it runs on lighter hardware than Immich: 2 cores and 3 GB of RAM.

• PhotoPrism: Personal photo management powered by Go and Google TensorFlow. Browse, organize, and share your personal photo collection, using the latest technologies to automatically tag and find pictures.

Two things set it apart from Google Photos. First, there is no official native mobile app; you install it as a progressive web app and upload from phones with a WebDAV-capable sync app. Second, some features are reserved for paying members. The Community edition is free under the AGPL; Essentials (€2 per month, billed annually) adds extra user roles, 3D and satellite maps and enhanced geocoding, and Plus (from €6 per month) adds web-based user management and other advanced options. Our PhotoPrism deploy guide covers the Docker setup.

Ente: end-to-end encrypted, self-hosted or not

Ente solves a problem the other two do not: your server never sees your photos. Files are encrypted on your device before upload, and face recognition and semantic search run on your phone or computer, not on the server. Its cryptography has been audited by Cure53, Symbolic Software and Fallible.

• Ente: An end-to-end encrypted photo-sharing platform (alternative to Google Photos, Apple Photos).

Ente runs a hosted service with a 10 GB free tier and paid plans from $2.49 per month for 50 GB up to $19.99 for 2 TB, shareable with up to five family members. The same code is open source under AGPL-3.0 and self-hostable. The server, called Museum, is written in Go and needs PostgreSQL plus S3-compatible object storage such as MinIO, Backblaze B2 or Wasabi. A quickstart script sets everything up, and the server needs only 1 GB of RAM. The main gotcha: clients upload directly to your storage bucket through pre-signed URLs, so the bucket endpoint must be reachable from your phones, not just from the server.

Ente's repository is also the busiest of the three, with 16,902 commits in the last year, partly because it holds the server and every client app in one monorepo.

Which one should you choose?

• Choose Immich if you want to stop paying for Google Photos or iCloud and have a server with 8 GB of RAM or more. It is the most complete experience and the one your family will adopt without complaint.
• Choose Ente if privacy is the point, if you host for other people, or if your storage lives on a provider you do not fully trust. You can also start on Ente's cloud and move to your own server later.
• Choose PhotoPrism if you have a large existing archive to organise, mostly browse on a computer, or need to run on modest hardware.

Many self-hosters run Immich for phone backup and PhotoPrism read-only on the same archive for its search and metadata tools. That works fine, as long as only one app writes to the library.

Other options worth knowing

• LibrePhotos: Photo management service with a slight focus on cool graphs (alternative to Google Photos).
• Photoview: Simple and user-friendly photo gallery for personal servers. It is made for photographers and aims to provide an easy and fast way to navigate directories, with thousands of high resolution photos.
• Nextcloud Memories: Fast, modern and advanced photo management suite. Runs as a Nextcloud app.

LibrePhotos is an MIT-licensed alternative with face recognition, Photoview is a simple, fast gallery for existing folders, and Nextcloud Memories adds a Google Photos-style timeline if you already run Nextcloud.

Bottom line

Immich is the default recommendation, Ente is the privacy pick, and PhotoPrism is the archivist's tool. Whichever you pick, set up backups first: a photo server that is your only copy is not a backup. Compare every open-source Google Photos alternative, browse the photo gallery category, see the head-to-head data for Immich vs PhotoPrism and Immich vs Ente, or start with the Immich guide.

A shared history

The two servers have the same roots. Emby (originally Media Browser) was open source until 2018, when version 3.5.3 was relicensed as closed source and its build scripts became proprietary. In December 2018 a group of users forked the last open release, 3.5.2, and called it Jellyfin. Jellyfin was then ported to modern .NET and has grown into the most active open-source media server: 2,025 commits in the last 12 months, version 12.2 released on October 5, 2026, and about 58,000 GitHub stars.

That history explains why the two look alike: libraries, users, metadata providers and the web interface share a common ancestor. The difference is in the business model.

Jellyfin vs Emby at a glance

Emby prices are from its Premiere page as of October 2026.

Pricing: what Emby Premiere unlocks

Emby's server is free to install and stream from in a browser. Emby Premiere is what turns it into a full media platform. According to Emby's own feature list, Premiere is required for:

• Hardware (GPU) transcoding
• DVR scheduling and series recordings
• Offline downloads to phones and tablets
• Full use of the Emby apps on Android, iOS, Fire TV, Xbox and PlayStation
• Cinema intros, the cover art plugin, scheduled content conversion and folder sync
• Server backup and restore, CarPlay and Android Auto, and Alexa or Google Home control

Some apps can be unlocked individually instead of buying Premiere, so check Emby's feature matrix for your exact devices.

Jellyfin has none of this. There are no tiers, no unlocks and no subscription. Your only costs are hardware and electricity, and the GPL licence means no future owner can move existing features behind a paywall.

Transcoding and hardware

Transcoding converts video on the fly when a client cannot play the original file or your connection is too slow. On a CPU this is heavy; with Intel Quick Sync or a GPU it is cheap and quiet.

Jellyfin supports hardware acceleration through Intel Quick Sync, NVIDIA NVENC, AMD AMF, VA-API, Apple VideoToolbox and Rockchip at no cost, so a low-power mini PC can serve several streams. On Emby, hardware transcoding is a Premiere feature; without it, every transcode falls back to the CPU. If most of your devices direct-play your files, this matters less, but remote streaming on a slow upload almost always needs transcoding.

Our Jellyfin deploy guide covers Docker Compose, passing a GPU or /dev/dri into the container, and HTTPS behind a reverse proxy.

• Jellyfin: Media server for audio, video, books, comics, and photos with a sleek interface and robust transcoding capabilities. Almost all modern platforms have clients, including Roku, Android TV, iOS, and…

Apps and experience

Emby's apps have historically been a strength, with good support across smart TVs, consoles and streaming sticks, and some users find its interface and metadata handling a little more refined. If your household lives on a TV platform where Emby's app is clearly better, that is a legitimate reason to pay.

Jellyfin's official clients now cover web, Android, iOS, Android TV and Fire TV, Roku, LG webOS, Samsung Tizen, Xbox and desktop, and third-party clients such as Infuse, Swiftfin and Findroid add more choice. Plugins handle intro skipping, subtitle downloads and extra metadata sources. Rough edges remain on some TV platforms, so test the clients your family actually uses before committing.

If you prefer a player on the TV itself rather than a server, Kodi can connect to Jellyfin through an add-on and works well on a dedicated media box.

Privacy and openness

Both servers keep your media and library database on your own hardware. Emby offers an optional Emby Connect account for easier remote sign-in; Jellyfin uses only local accounts and has no central service at all.

The bigger difference is openness. Jellyfin's code is public, so anyone can audit what the server does, patch a bug or fork it if the project ever changes direction. Emby's code is closed, so you are trusting the vendor, and you depend on it for both features and licence terms.

Who should choose which

Choose Jellyfin if you want every feature free, you care about open source, you want hardware transcoding without a subscription, or you are building a media stack you fully control.

Choose Emby if you already own a lifetime Premiere licence, a specific Emby client works better on your TV, or you prefer Emby's interface and are comfortable with a proprietary product.

Coming from Plex? Read our Jellyfin vs Plex comparison and the full list of open-source Plex alternatives.

Music and audiobooks

Both servers handle music, but dedicated apps do it better. Navidrome is a lightweight music server that works with any Subsonic client, and Audiobookshelf is the best self-hosted choice for audiobooks and podcasts. See how Navidrome and Jellyfin compare for music in our Navidrome vs Jellyfin page.

• Navidrome Music Server: Modern Music Server and Streamer, compatible with Subsonic/Airsonic.
• Audiobookshelf: Audiobook and podcast server. It streams all audio formats, keeps and syncs progress across devices. Comes with apps for Android and iOS.

The verdict

Emby and Jellyfin started as the same code, but they took opposite paths. Emby became a freemium product where the features self-hosters care about most require Premiere. Jellyfin stayed open source and free, and it is now the more active project. Unless a specific Emby app is a must-have, start with Jellyfin, and browse every self-hosted media server in the catalog if you want to compare more options.

Jellyfin vs Plex at a glance

Pricing: what changed

Plex rewrote its pricing in 2025 and again in 2026. On April 29, 2025, Plex Pass went to $6.99 a month or $69.99 a year, and streaming your personal movies and TV outside your home network stopped being free. You now need either a Plex Pass on your own account, a Plex Pass on the account of the person who runs the server, or a Remote Watch Pass, which lists at $2.99 a month or $29.99 a year. In April 2026 that requirement expanded to more devices, including Fire TV, Samsung, LG and Vizio TVs, PlayStation and Xbox.

The lifetime pass, long the best deal in home media, went from $119.99 to $249.99 in 2025, then to $749.99 for new buyers on July 1, 2026, alongside a new five-year plan at $249.99. Existing lifetime holders keep their pass.

Jellyfin has no tiers at all. The project's own wording is that the server and official clients are free "now and always", and there is no premium feature list to work around. Your only costs are hardware and electricity.

Features and experience

Plex's strength is polish. Its apps are on almost every device ever sold, metadata matching is excellent, and sharing a library with a relative takes an email address. It also bundles free ad-supported movies and live TV channels, which some households like and others turn off immediately.

Jellyfin has closed most of the gap. The web client is fast, the official apps cover Android, iOS, Android TV and Fire TV, Roku, LG webOS, Samsung Tizen and Xbox, and plugins add features such as intro skipping, subtitle downloads and extra metadata sources. Live TV and DVR work with a tuner or IPTV source. The project is also moving quickly: it shipped version 12.0 in September 2026 and 12.2 on October 5, with 2,025 commits in the last 12 months.

• Jellyfin: Media server for audio, video, books, comics, and photos with a sleek interface and robust transcoding capabilities. Almost all modern platforms have clients, including Roku, Android TV, iOS, and…

Where Jellyfin still asks more of you is setup. There is no cloud relay, so remote access means opening a port behind a reverse proxy, or using a private network such as Tailscale. Our Jellyfin deploy guide walks through Docker Compose, HTTPS and hardware acceleration step by step.

Transcoding and hardware

Transcoding converts a video on the fly when a device cannot play the original format or your upload speed is too low. Doing it on the CPU is slow; doing it with a GPU or Intel Quick Sync is cheap and quiet.

On Plex, hardware transcoding is a Plex Pass feature. On Jellyfin it is free and supports Intel Quick Sync, NVIDIA NVENC, AMD AMF, VA-API, Apple VideoToolbox and Rockchip boards. In practice that means a low-power Intel N100 mini PC can serve several 1080p transcodes on Jellyfin without paying anyone. If most of your devices play your files directly, neither server needs to transcode much.

Privacy and control

Plex routes sign-in, sharing and discovery through its own cloud. That is what makes it convenient, and it is also why a Plex account breach matters: in September 2025 Plex asked users to reset their passwords after unauthorised access to account data, which included emails, usernames and hashed passwords.

Jellyfin keeps everything on your server. Users are local accounts, nothing phones home, and the source code is auditable. For a self-hosting setup built around owning your data, that difference is the whole point.

Who should choose which

Choose Jellyfin if you are comfortable with Docker, you want remote streaming and hardware transcoding without a subscription, or you want a media server that cannot change its terms on you. It pairs naturally with the rest of the self-hosted media stack, such as Sonarr and Radarr for library management.

Choose Plex if you share your library with many non-technical people across many TV brands, you already own a lifetime pass, or you want the free ad-supported channels.

Run both if you are unsure. Point both servers at the same media folders, read-only, invite your household to Jellyfin, and retire Plex once nobody misses it.

Beyond movies: music and audiobooks

Jellyfin handles music and books, but dedicated apps are better at them. Navidrome is a lightweight music server that works with Subsonic clients, and Audiobookshelf is the best self-hosted option for audiobooks and podcasts, with progress sync across devices.

• Navidrome Music Server: Modern Music Server and Streamer, compatible with Subsonic/Airsonic.
• Audiobookshelf: Audiobook and podcast server. It streams all audio formats, keeps and syncs progress across devices. Comes with apps for Android and iOS.

The verdict

Plex built the category, but its 2025 and 2026 pricing changes moved the features self-hosters care about most behind a subscription. Jellyfin gives you the same core experience for free, under a licence that guarantees it stays that way. Start with our Jellyfin guide, compare other open-source Plex alternatives, or browse every self-hosted media server in the catalog.

Joplin vs Obsidian at a glance

Prices are as listed on each vendor's site as of October 2026.

Ownership: what "notes you own" means

Both apps are local-first. Your notes live on your device, and neither locks your content in a proprietary cloud. The ownership question is about the software and the sync layer.

Obsidian stores each note as a Markdown file in an ordinary folder. That is a strong form of ownership over content: any editor can open the files, and you can back them up with anything. But the app itself is closed source. You cannot audit it, fork it or keep it running if the company changes course, and the only official sync is a paid service.

Joplin is open source end to end. The desktop, mobile and terminal apps are AGPL-3.0, with about 56,600 GitHub stars and more than 2,000 commits in the last year. Notes are written in Markdown but stored in a local database, and you can export them as Markdown files at any time. Sync is built in and pluggable, so you choose where encrypted notes go.

• Joplin: Note taking application with markdown editor and encryption support for mobile and desktop platforms. Runs client-side and syncs through a self hosted Nextcloud instance or similar (alternative to…

Sync and self-hosting

This is where Joplin pulls ahead for self-hosters. It supports these sync targets out of the box:

• Joplin Server, the official self-hosted sync server, which runs in Docker with PostgreSQL
• Nextcloud or any WebDAV server
• S3-compatible object storage
• Dropbox, OneDrive or a local or network folder
• Joplin Cloud, the paid hosted service, from €2.99 a month (2 GB)

End-to-end encryption works with every target, so even a third-party cloud only stores ciphertext.

One licensing nuance: Joplin Server is not AGPL. It ships under the Joplin Server Personal Use License, which covers individuals. Businesses that want to self-host it buy Joplin Server Business, from €3.33 per user per month billed annually. Teams that prefer to stay fully open source can sync through Nextcloud or WebDAV instead.

Obsidian has no self-hosted sync of its own. Obsidian Sync costs $4 a month billed annually or $5 billed monthly and includes end-to-end encryption and version history. The self-hosting workarounds are well established:

• Syncthing syncs the vault folder peer to peer between your devices, including Android. See our Syncthing guide.
• Any file-sync tool, such as Nextcloud, can sync the vault folder.
• The community Self-hosted LiveSync plugin syncs through a CouchDB server you run.

These work, but they are add-ons you maintain, and iOS file sync is the usual weak spot.

Writing and linking

Obsidian is built for connected notes. Wikilinks, backlinks, the graph view, Canvas and a huge range of community plugins (task managers, Dataview queries, spaced repetition, publishing) make it the stronger tool for a personal knowledge base or "second brain." The editor is fast and handles large vaults well.

Joplin is organised around notebooks and tags, closer to Evernote. It supports links between notes, a rich-text or Markdown editor, attachments, to-dos, and a reliable web clipper. Plugins add features such as a backlinks panel or note graph, but the ecosystem is smaller. For many people coming from Evernote or OneNote, that structure is a feature, not a limitation.

Pricing

Both apps are free to use. Obsidian is free for commercial use too; its $50 per user per year commercial licence is optional support. You pay only if you want Obsidian Sync ($4 a month annually) or Obsidian Publish ($8 a month annually per site).

Joplin is free with any self-managed sync target. Joplin Cloud starts at €2.99 a month for 2 GB, and Pro is €5.99 a month for 30 GB with notebook sharing. Self-hosted Joplin Server is free for personal use.

Other open-source options

If neither fits, the note-taking category has strong open-source alternatives to Obsidian:

• SilverBullet: Note-taking application optimized for people with a hacker mindset.
• Logseq: Privacy-first, local-first outliner and knowledge graph.
• TriliumNext Notes: Cross-platform hierarchical note taking application with focus on building large personal knowledge bases (fork of Trilium Notes).

SilverBullet is a self-hosted, browser-based Markdown notebook with wikilinks and queries, the closest thing to a self-hosted Obsidian. Logseq is an open-source outliner with backlinks and a graph. TriliumNext Notes is a hierarchical knowledge base with its own sync server; see Joplin vs TriliumNext for a direct comparison.

Which should you choose?

• Choose Joplin if you want an open-source app, built-in encrypted sync to a server you control, a notebook structure familiar from Evernote, and no subscriptions.
• Choose Obsidian if linked notes, graph navigation and plugins matter most, plain Markdown files in a folder are your idea of ownership, and a closed-source app is acceptable.
• Choose SilverBullet or Logseq if you want Obsidian-style linking with an open-source licence.

Browse every open-source Obsidian alternative and Evernote alternative in the catalog to compare stars and activity side by side.

What you are actually running

Matrix is an open, federated chat protocol. A homeserver stores your users' accounts and room history and federates with every other Matrix server, so your users can join rooms hosted anywhere. People connect with a client such as Element, which works with any homeserver. You self-host the homeserver; the client is usually just an app.

This makes Matrix a strong self-hosted alternative to Slack and Discord, with end-to-end encryption and bridges to other networks.

The four servers compared

Release and activity data for Synapse and Tuwunel comes from the appsgit catalog: Synapse logged 817 commits in the last 12 months and Tuwunel 2,186. Conduit's figures are from its GitLab project.

• Synapse: Server for Matrix, an open standard for decentralized persistent communication.
• Tuwunel: High-performance and feature-rich chat server for Matrix, and the successor to conduwuit (fork of Conduit).

Synapse: the most complete homeserver

Synapse is where new Matrix features appear first and the server most bridges, bots and admin tools are tested against. Element moved it to the element-hq organisation and relicensed it under AGPL-3.0 (with a commercial licence also available) in late 2023.

Strengths:

• Completeness. If a feature exists in the Matrix spec or in Element's newest clients, Synapse is the most likely server to support it.
• Scaling. Workers let you split a busy server across processes.
• Ecosystem. Official Docker images (matrixdotorg/synapse and ghcr.io/element-hq/synapse), and the widely used matrix-docker-ansible-deploy playbook that sets up Synapse with Postgres, Element, a TURN server and bridges.

Trade-offs: it needs PostgreSQL (Synapse's own docs say SQLite is only for testing), and it uses noticeably more memory than the Rust servers, especially once users join large federated rooms. Plan for a proper VPS or home server rather than the smallest instance.

Tuwunel: lightweight and actively funded

Tuwunel describes itself as a high-performance Matrix homeserver in Rust and the official successor to conduwuit. It is "primarily sponsored by the government of Switzerland", where it is deployed for citizens, and is developed by full-time staff.

Why self-hosters like it:

• One container, no external database. RocksDB is embedded, so a basic deployment is a single service plus a reverse proxy.
• Low resource use. It is comfortable on small VPS instances and home servers.
• Easy upgrades. The project states that downgrading is always safe, and it migrates Conduit and conduwuit databases automatically on first start.
• Packaging. Docker images (jevolk/tuwunel and ghcr.io/matrix-construct/tuwunel, both amd64 and arm64) plus packages for Debian, Ubuntu, Fedora, Arch, Alpine, NixOS and others.

The main limitation is migration from Synapse, which is planned but not supported yet. Some newer Element features and admin tools are built against Synapse first, so check what you need before choosing.

A note on names: the original conduwuit repository has been archived. Besides Tuwunel, a separate community fork called continuwuity also continues that codebase.

Conduit: the original, still in beta

Conduit started the Rust homeserver movement, and its goal remains "an efficient Matrix homeserver that's easy to set up and just works", including on a Raspberry Pi. It is still released regularly. Its README is candid that it is beta: you can join and use most rooms, but a few features are missing, including emoji verification for encrypted chats over federation and outgoing read receipts, typing notifications and presence over federation.

Choose Conduit if you want the most minimal option and can live with those gaps. For most people starting fresh, Tuwunel offers the same lightweight design with a faster pace of development.

Dendrite: do not start here

Dendrite was Element's second-generation homeserver in Go. Its README now states it is in maintenance mode, "meaning only security fixes are being applied". If you run Dendrite today, it keeps working, but plan a move. For a new server, pick Synapse or Tuwunel.

How to deploy any of them

The pieces are the same regardless of server:

1. Choose your server name. User IDs look like @alice:example.com. The server name (example.com) is permanent, so use a domain you will keep.
2. Delegate federation. You can run the server on matrix.example.com while user IDs use example.com, by serving two small JSON files at https://example.com/.well-known/matrix/server and /.well-known/matrix/client. That also removes the need to open port 8448.
3. Put it behind a reverse proxy with HTTPS. Caddy does this in a few lines; see the Caddy guide, or the Traefik guide if you already use labels.
4. Run it with Docker Compose. Keep the config file and data directory in bind mounts, pin the image version and back up the data directory (and Postgres for Synapse). Our Docker Compose tutorial covers the patterns.
5. Lock down registration. Disable open registration or require registration tokens, otherwise spammers will find your server.
6. Test federation with a public federation tester before inviting people.

Voice and video calls need more: a TURN server for one-to-one calls, and Element's newer group calling relies on a separate real-time media backend. Budget time for these if calls matter to you.

Our recommendation

• A family or a group of friends: Tuwunel on a small VPS or home server.
• A company, an open-source community or a public server: Synapse with PostgreSQL.
• An existing Dendrite server: keep it patched and plan a migration.
• Just curious: Tuwunel or Conduit, because a single container is easy to throw away.

If you would rather run a simpler, non-federated team chat, compare Mattermost vs Rocket.Chat and browse the team chat category. New to running servers? Start with our self-hosting roadmap.

• Element: Fully-featured Matrix client for Web, iOS & Android.

Why look for an n8n alternative?

n8n is excellent, and for most companies automating their own work its licence makes no practical difference. People look elsewhere for three reasons:

1. Licence. The Sustainable Use License forbids offering n8n as a hosted service to others and keeps SSO, environments and Git version control behind paid Business (€667 a month billed annually, as of October 2026) or Enterprise licences. Agencies, SaaS builders and organisations with open-source procurement rules need something else.
2. Audience. n8n's node canvas suits technical users. Non-developers often find a simpler builder easier.
3. Workload. Data pipelines, long-running jobs and IoT flows each have tools built specifically for them.

n8n alternatives at a glance

Star counts are from our catalog in October 2026.

Activepieces: the closest no-code replacement

Activepieces targets the same user as Zapier and Make: someone who wants to connect apps without writing code. Flows are built as a clean vertical list of steps, and integrations ("pieces") are TypeScript packages, many contributed by the community. Everything outside the enterprise directories is MIT, an OSI-approved licence, which makes it the most permissive option here and the only one designed to be embedded in your own product. It also exposes its pieces as an MCP server for AI assistants. With more than 5,600 commits in the last year, it is moving fast.

• Activepieces: No-code business automation tool like Zapier or Tray. For example, you can send a Slack notification for each new Trello card.

Compare it directly in n8n vs Activepieces or our longer n8n vs Zapier vs Activepieces write-up.

Windmill: for developers who think in scripts

Windmill turns scripts in Python, TypeScript, Go, Bash, SQL and other languages into workflows, scheduled jobs and internal UIs, with a fast Rust-based engine. If your team would rather write a function than drag nodes, it is the strongest option.

Read the licence carefully. Code built without the enterprise feature flag is AGPL-3.0. The Community Edition Docker images also include proprietary code that is free to use within built-in limits; as of October 2026 its pricing page lists up to 50 users, 10 SSO users and 3 workspaces. Larger teams need an Enterprise licence.

Kestra: orchestration for data and infrastructure

Kestra is an event-driven orchestrator where workflows are declared in YAML, edited in a built-in code editor and versioned like code. Tasks can run Python, Node.js, R, Go or shell, and hundreds of plugins cover databases, cloud services and APIs. It is closer to Airflow than to Zapier: choose it for ETL, scheduled data jobs and infrastructure automation rather than "when a form is submitted, post to Slack." The core is Apache-2.0; RBAC, governance and advanced worker management are in a separate Enterprise Edition.

Node-RED: the classic for IoT and home automation

Node-RED is a browser-based flow editor built on Node.js and hosted by the OpenJS Foundation under Apache-2.0. It is lightweight enough for a Raspberry Pi, and its community nodes cover MQTT, serial ports, Modbus, Home Assistant and much more. For business SaaS integrations it asks for more work than n8n, but for devices and sensors it is the natural choice. See n8n vs Node-RED.

Huginn: agents that watch the web

Huginn, a Ruby on Rails app under the MIT licence, predates n8n by years. You create agents that fetch websites, RSS feeds, APIs and email, watch for changes, and trigger other agents or notifications. It is perfect for price alerts, scraping and personal "if this changes, tell me" automations, though its interface shows its age. See n8n vs Huginn.

Automatisch: Zapier-style, but slowing down

Automatisch offers a simple trigger-and-action builder aimed at teams who want a self-hosted Zapier, and it is AGPL-3.0 apart from files marked .ee.. The honest caveat: as of October 2026 its repository shows only six commits in the past year, and the latest release, v0.15.0, is from August 2025. Treat it as a project to evaluate carefully, not a default choice.

• Windmill: Fast workflow engine and internal tool builder that turns scripts into UIs and automations.
• Kestra: Event-driven, language-agnostic platform to create, schedule, and monitor workflows. In code. Coordinate data pipelines and tasks such as ETL and ELT.
• Node RED: Browser-based flow editor that helps you wiring hardware devices, APIs and online services to create IoT solutions.
• Huginn: Build agents that monitor and act on your behalf.

What to check before you switch

Migrating automations is real work, because none of these tools imports n8n workflows. Before you commit, list your five busiest workflows and confirm the replacement has native integrations for every service they touch, or that a generic HTTP step can cover the gap. Check how each tool stores credentials and how you back up its database and encryption key. Finally, look at recent commit activity and release dates on each app page in our catalog: a permissive licence matters less than a project that is still maintained.

How to choose

• Replacing n8n for business users: Activepieces.
• Your team writes code and wants internal tools too: Windmill.
• Data pipelines and scheduled jobs: Kestra (or Apache Airflow if you are already in the Python data ecosystem).
• Devices, sensors and home automation: Node-RED.
• Monitoring websites and feeds: Huginn.
• You like n8n but worry about cost: the self-hosted Community edition is free for internal use. Our n8n deploy guide covers a production setup.

If you are leaving a cloud tool rather than n8n, see n8n vs Make, every open-source Zapier alternative, and the full automation category.

n8n vs Make at a glance

Prices are list prices from each vendor's pricing page as of October 2026.

Pricing: credits vs executions

This is the difference that matters most once workflows grow.

Make charges a credit for each module action. Its own pricing page describes it this way: each module action in a scenario, like adding a Google Sheets row or fetching Gmail data, counts as one credit. The Free plan includes 1,000 credits a month and runs scenarios at most every 15 minutes. Paid plans start with Core at $9 a month, then Pro at $16 and Teams at $29 when billed monthly, each with 10,000 credits at the entry tier and a one-minute minimum interval; annual billing saves about 15%. Enterprise is custom.

n8n charges an execution for each complete workflow run, regardless of step count. n8n Cloud starts with Starter at €20 a month (2,500 executions) and Pro at €50 a month (10,000 executions), both billed annually, with unlimited users and workflows on every plan. The self-hosted Community edition has no execution limits at all.

A worked example: a scenario with eight module actions that runs 2,000 times a month.

• Make: about 8 × 2,000 = 16,000 credits, more than the 10,000 included in the entry tier of any paid plan.
• n8n Cloud: 2,000 executions, inside Starter.
• Self-hosted n8n: the cost of your server. A small VPS handles this easily.

Make's per-action model is cheaper than it looks for short, infrequent scenarios, and its entry plan costs less than n8n's. It gets expensive when scenarios loop over many items, because every iteration of every module consumes a credit.

Building workflows

Make's scenario editor is one of the best-designed automation interfaces available. Modules appear as circles on a canvas, routers split paths, iterators and aggregators handle lists, and every run can be replayed with the data each module received. Non-developers pick it up quickly, and Make's library of ready-made app modules is larger than n8n's.

n8n uses a node canvas that looks similar but leans technical. Any API is reachable through the HTTP Request node, workflows can branch, loop, merge and call sub-workflows, and Code nodes run JavaScript or Python inline when a built-in node falls short. That last point is the real divide: in Make you mostly work within the modules and formula functions it gives you, while in n8n you can drop to code at any step. With about 207,000 GitHub stars and more than 9,000 commits in the past year, n8n is also one of the most active projects in our automation category.

• n8n: Free node based Workflow Automation Tool. Easily automate tasks across different services.

Self-hosting and data control

Make cannot be self-hosted. It runs on AWS in the EU and North America, so every record your scenarios touch passes through Make's infrastructure. Its on-prem agent lets cloud scenarios reach systems inside your network, such as a database or an ERP, but the orchestration stays in Make's cloud.

n8n's Community edition runs in a single Docker container with SQLite and scales to PostgreSQL and queue mode with Redis workers. Credentials, workflow data and execution logs stay on your server, which matters for regulated data and for internal systems you do not want exposed to the internet. Our n8n deploy guide covers Docker Compose, HTTPS and backups. Back up the encryption key along with the database: without it, stored credentials cannot be decrypted.

The licence is the caveat. n8n is fair-code under the Sustainable Use License, not OSI open source. Internal business use is free, but you may not sell n8n itself as a hosted service, and features such as SSO, environments and Git-based version control need a paid Business licence (€667 a month billed annually) or Enterprise. If you need a truly open-source licence, read our roundup of open-source n8n alternatives.

AI agents

Both tools now pitch AI automation. n8n has an AI Agent node with tool calling, memory and vector store integrations, and it can act as an MCP client or server. Because it self-hosts, you can point it at a local model served by Ollama and keep prompts and data entirely on your own hardware. Make offers AI agents and AI modules inside its cloud, which is convenient but means your data goes to Make and to the model provider it calls.

AI workflows also make billing differences sharper. Agents call tools in loops, and on Make each of those module actions uses credits, while on n8n the whole run is one execution.

Migrating from Make to n8n

There is no importer, so you rebuild each scenario. Most Make concepts map cleanly: scenarios become workflows, routers become IF or Switch nodes, iterators become n8n's item-based processing or Loop Over Items, and webhooks remain webhooks. Anything without a native n8n node can use the HTTP Request node with the service's API. Start with your highest-volume scenarios, since that is where the savings are.

Which should you choose?

• Choose n8n if someone on your team is comfortable with Docker or code, your workflows are long or run often, you need data to stay on your own servers, or you are building AI agents. Self-hosted, it removes per-run costs entirely.
• Choose Make if your team is non-technical, your scenarios are short and low-volume, you rely on a niche app module only Make offers, or you want no infrastructure to maintain.
• Consider Activepieces if you like Make's ease of use but want an MIT-licensed tool you can self-host. It is the closest open-source match for business users.

• Activepieces: No-code business automation tool like Zapier or Tray. For example, you can send a Slack notification for each new Trello card.

For more head-to-heads, see n8n vs Zapier vs Activepieces, compare live GitHub stats for n8n vs Activepieces, or browse every open-source Zapier alternative.

The short version

All prices are billed annually, as listed on each vendor's pricing page in October 2026.

Licensing: what "open" means here

This is the difference most comparisons gloss over.

Activepieces is open source in the strict sense: everything outside its enterprise directories is MIT licensed. You can self-host it, modify it and even embed it in your own product.

n8n is "fair-code" under its Sustainable Use License. You can read the code, self-host it and use it for your own business at no cost, but you may not offer n8n itself as a hosted service to others, and files marked as enterprise need a commercial licence. For the vast majority of companies automating their own work, this makes no practical difference. For agencies and SaaS builders, it does.

Zapier is a closed, cloud-only service. There is nothing to self-host.

Pricing: tasks vs executions

The billing unit matters more than the sticker price. Zapier charges per task, which is every action step that runs successfully. n8n charges per execution, one complete run of a workflow no matter how many steps it has. Activepieces charges per credit, where one flow run is one credit regardless of steps, and AI steps cost extra.

Take a simple five-step workflow (a trigger and four actions) that runs 1,000 times a month:

• Zapier: 4 actions × 1,000 runs = 4,000 tasks, well past the 750-task entry tier of the Professional plan.
• n8n Cloud: 1,000 executions, inside the Starter plan's 2,500.
• Activepieces Cloud: 1,000 credits, inside the Free plan.
• Self-hosted n8n or Activepieces: whatever your server costs. A $5 to $10 VPS handles thousands of runs a day.

On n8n's side, the self-hosted Business licence (€667 a month, billed annually) adds SSO, environments, Git-based version control and queue-mode scaling; most small teams never need it. Activepieces' paid cloud plans are flat-priced: Plus at $20 a month for 10,000 credits and five users, Team at $200 a month for 50,000 credits and 25 users.

Integrations and building workflows

Zapier's catalog is its moat. If your team depends on a niche CRM or a regional accounting tool, Zapier probably has a ready-made trigger for it.

n8n has fewer native integrations but far more flexibility. Any API is reachable through the HTTP Request node, workflows can branch, loop and merge, and Code nodes run JavaScript or Python inline. Its canvas shows data flowing between nodes, which makes debugging complex workflows much easier. With about 207,000 GitHub stars and over 9,000 commits in the last year, it is also one of the most active projects in our catalog.

• n8n: Free node based Workflow Automation Tool. Easily automate tasks across different services.

Activepieces aims at the Zapier user. Its builder is a clean vertical flow rather than a node graph, its 760-plus integrations ("pieces") are TypeScript packages, and about 60% of them were contributed by the community. It is the easiest of the three open options to hand to a non-technical colleague.

• Activepieces: No-code business automation tool like Zapier or Tray. For example, you can send a Slack notification for each new Trello card.

AI agents and MCP

All three now pitch themselves as AI automation platforms. n8n has an AI Agent node with tool calling, memory and vector stores, and can act as both an MCP client and an MCP server, which makes it a popular backend for self-hosted agents. Activepieces exposes its whole platform, including every piece, as an MCP server that works with Claude, Cursor, VS Code and ChatGPT, and that MCP access is free on every plan, cloud or self-hosted. Zapier sells AI agents and chatbots as separately priced add-ons.

If you pair either open-source tool with a local model from Ollama, your automations and your AI can run entirely on your own hardware.

Self-hosting effort

Both open-source tools run in Docker. n8n starts as a single container with SQLite and moves to PostgreSQL and queue mode with Redis workers as volume grows. Our n8n deploy guide covers the production setup with HTTPS and backups. Activepieces runs as one app container, typically backed by PostgreSQL and Redis in production. Either one needs the usual care: updates, a reverse proxy and backups of the database and encryption key. Lose the encryption key and you lose every stored credential.

Other open-source options

If neither fits, the automation category has strong specialists:

• Node RED: Browser-based flow editor that helps you wiring hardware devices, APIs and online services to create IoT solutions.
• Windmill: Fast workflow engine and internal tool builder that turns scripts into UIs and automations.
• Kestra: Event-driven, language-agnostic platform to create, schedule, and monitor workflows. In code. Coordinate data pipelines and tasks such as ETL and ELT.
• Huginn: Build agents that monitor and act on your behalf.

Node-RED is the classic for IoT and home automation flows, Windmill turns scripts into internal tools and workflows, Kestra is built for data pipelines and orchestration, and Huginn runs agents that watch the web and act on changes.

Which should you choose?

• Choose n8n if you have someone technical on the team, your workflows involve real logic, or you are building AI agents. It is the most powerful of the three and free to self-host for internal use.
• Choose Activepieces if you want an OSI open-source licence, a builder anyone can use, flat cloud pricing or the option to embed automation in your own product.
• Choose Zapier if you need an integration only Zapier has, your volume is low, and you value never maintaining a server over cost and control.

See every open-source Zapier alternative and IFTTT alternative side by side, compare live GitHub stats for n8n vs Activepieces, or start with the n8n guide.

Ollama vs LM Studio at a glance

Prices are from each vendor's pricing page as of October 2026. Paid plans on both sides cover hosted cloud models; running models on your own machine is free on both.

What each one is for

Ollama started as a command-line tool and is still server-first. You run ollama run with a model name and it downloads the model, loads it on your GPU or CPU, and serves it over an HTTP API. Modelfiles let you package a base model with a system prompt and parameters. It has about 182,000 GitHub stars and more than 1,000 commits in the last year, and nearly every self-hosted AI app supports it out of the box.

• Ollama: Get up and running with Llama 3.3, DeepSeek-R1, Phi-4, Gemma 3, and other large language models.

LM Studio is a desktop application first. You search for models in the app, see which quantisations fit your RAM or VRAM, download them, and chat in a polished interface with document attachments. Under the hood it uses llama.cpp, and on Apple Silicon it can also use Apple's MLX engine, which is often the fastest way to run models on a Mac. It added a CLI (lms) and a headless version called llmster for servers and CI, so it is no longer desktop-only.

Setup and day-to-day use

For a homelab server, Ollama is the shorter path. Install it with a single script on Linux or run the official Docker image with your GPU passed through, and the API is ready. Our Ollama deploy guide covers Docker Compose with NVIDIA and AMD GPUs, model storage and securing the API.

For a laptop or workstation, LM Studio is friendlier. The model browser removes the guesswork about file names and quantisations, and switching models or comparing their answers takes a click. Ollama's own desktop app on macOS and Windows now includes a simple chat window too, but LM Studio's interface is more complete.

APIs and integrations

Both expose an OpenAI-compatible local server, so tools written for the OpenAI API can use your machine by changing the base URL. Ollama also has its own native API, which is what most integrations target. LM Studio adds a REST API and official Python and TypeScript SDKs, and it can install MCP servers and use their tools with local models directly in the app.

In practice, if you want to plug a local model into self-hosted apps such as Open WebUI, AnythingLLM or an automation in n8n, Ollama is the most widely supported backend. LM Studio works too wherever an OpenAI-compatible endpoint is accepted.

Hardware and performance

Speed depends far more on your hardware and the model size than on the tool. Both use llama.cpp-based engines, so on the same GPU with the same GGUF model the results are close. The notable exception is Apple Silicon, where LM Studio's MLX engine can be faster for models published in MLX format.

Memory is the real constraint. A model has to fit in VRAM, or unified memory on a Mac, to run quickly; anything that spills to system RAM slows down sharply. LM Studio shows an estimate of whether a model will fit before you download it, which is useful when you are learning what your machine can handle. Ollama loads and unloads models automatically as requests arrive, which suits a shared server.

Licensing and privacy

Both run models locally, and your prompts never leave your machine when you use local models.

The licence difference matters for the long term. Ollama is MIT-licensed, so you can audit it, modify it, package it and depend on it in your own products. LM Studio is proprietary. It has been free for work since July 2025, which removed the main business objection, but its terms are the vendor's to change. Both companies now sell hosted cloud models: Ollama's Pro and Max plans, LM Studio's Bionic+ and Pro plans. Neither is required for local use.

Front ends and alternatives

Most self-hosters pair Ollama with a web front end so the whole household or team can use it from a browser:

• Open-WebUI: User-friendly AI Interface, supports Ollama, OpenAI API.
• LibreChat: Enhanced ChatGPT-compatible AI chat interface supporting multiple AI providers, with multi-user auth, message search, and plugin support.
• AnythingLLM: All-in-one desktop & Docker AI application with built-in RAG, AI agents, No-code agent builder, MCP compatibility, and more.

Open WebUI is the most popular choice and has its own deploy guide. LibreChat supports many providers at once; see Open WebUI vs LibreChat. If you want a fully open-source server that also covers image generation, speech and embeddings, LocalAI is the main alternative to Ollama, compared in Ollama vs LocalAI.

Which should you choose?

• Choose Ollama if you want an open-source model server for a homelab, a backend for Open WebUI or automation tools, or anything running in Docker.
• Choose LM Studio if you want the best desktop experience for discovering and testing models, especially on an Apple Silicon Mac, and a closed-source app is acceptable.
• Use both if it helps: many people explore models in LM Studio on a laptop and run their chosen model through Ollama on a server.

Browse every self-hosted AI tool in the catalog, or see the full list of open-source ChatGPT alternatives.

How this list was built

r/selfhosted has no official leaderboard, and we did not scrape or count Reddit posts. Instead, we started from the apps that come up repeatedly in the subreddit's recurring threads ("what are you self-hosting?", "what should I install first?", "share your dashboard") and in community resources such as the awesome-selfhosted list. Then we checked each one against the appsgit catalog:

• Open-source licence and a public GitHub repository.
• Not archived, with commits in the last year.
• A Docker image or Compose setup.

The final order uses GitHub stars, a snapshot from October 6, 2026. Stars measure attention, not quality, so read the commit column too: a mature, focused project can be excellent with few commits.

The ranking

Why these apps keep getting recommended

The "first install" tier: Immich, Jellyfin, Uptime Kuma

Immich is the clearest success story in self-hosting: a Google Photos replacement with automatic phone backup, face recognition and a polished mobile app, plus one of the busiest repositories in the catalog. For many newcomers it is the app that makes self-hosting worth the effort. Our Immich guide gets it running, and Immich vs PhotoPrism vs Ente explains why it usually wins.

Jellyfin is the community's default media server, largely because it is free and unrestricted; see Jellyfin vs Plex. Uptime Kuma appears on nearly every dashboard screenshot because it is easy, pretty and immediately useful.

• Immich: Photo and video backup solution directly from your mobile phone (alternative to Google Photos).
• Jellyfin: Media server for audio, video, books, comics, and photos with a sleek interface and robust transcoding capabilities. Almost all modern platforms have clients, including Roku, Android TV, iOS, and…
• Uptime Kuma: Easy-to-use self-hosted uptime monitor with status pages and 90+ notification channels.

The "protect your data" tier: Vaultwarden, Paperless-ngx, Syncthing

Vaultwarden is the standard answer to "which password manager should I self-host?" It works with the official Bitwarden apps and runs in one small container. Its low commit count reflects a mature, focused codebase rather than neglect; Vaultwarden vs Bitwarden covers the details.

Paperless-ngx turns scanned letters and PDFs into a searchable archive with OCR and automatic tagging. Subreddit threads about going paperless almost always end up here. Start with the Paperless-ngx guide.

Syncthing keeps folders in sync between devices without any server in the middle, which is why it is often recommended alongside, or instead of, Nextcloud. See Nextcloud vs Syncthing.

The network tier: Pi-hole and AdGuard Home

Network-wide ad blocking is a classic first project. Pi-hole is the long-time favourite; AdGuard Home is a single binary with encrypted DNS built in. Opinions are split, so we wrote Pi-hole vs AdGuard Home.

The plumbing tier: Portainer, Nginx Proxy Manager, Homepage

These are the tools that make the rest manageable. Portainer gives a web UI for containers, Nginx Proxy Manager puts HTTPS in front of everything without editing config files (see Traefik vs Nginx Proxy Manager), and Homepage is the start page behind many of the dashboards people share.

The quality-of-life tier

Home Assistant is the most active project on this list by a wide margin. Frigate adds local AI object detection to security cameras. Actual is a popular budgeting app, Karakeep saves links and articles with AI tagging, Navidrome and Audiobookshelf handle music and audiobooks, and Mealie imports recipes from any website.

Also frequently recommended

A few favourites did not fit the table but appear constantly:

• Tailscale for remote access. It is not fully self-hosted, but Headscale is an open-source implementation of its control server.
• *The arr stack: Sonarr, Radarr and friends, covered in our Plex and Jellyfin home server guide.
• Reverse proxies such as Caddy and Traefik, for people who prefer config files to a web UI.

How to read the commit column

Stars and commits tell different stories, and r/selfhosted discussions often weigh both.

• High stars, high commits (Immich, Home Assistant, Nextcloud, Jellyfin, Stirling-PDF): large, fast-moving projects. Expect frequent releases, read release notes before upgrading and pin major versions.
• High stars, low commits (Vaultwarden, Syncthing, Pi-hole, AdGuard Home): mature tools that do one job well. Low churn is a strength for software that guards passwords, files or DNS.
• Mid stars, high commits (Mealie, Actual, Frigate): projects in a growth phase, often adding major features each release.

None of these numbers say whether an app fits your needs. They do tell you how much change to expect, which matters when you are responsible for upgrades. Every app page on appsgit shows the live numbers, the latest release and the licence, so you can check a project before committing your data to it.

What the community consistently advises

Beyond app picks, r/selfhosted threads repeat the same practical advice:

• Back up before you trust an app with anything important. The 3-2-1 rule comes up in almost every data-loss story.
• Do not expose admin panels to the internet. Use a VPN for anything that is not meant for other people.
• Start small. One reliable mini PC beats a rack of noisy servers; our homelab for beginners guide explains what to buy.
• Use Docker Compose. It is the common language of nearly every install guide; learn it with our Docker Compose tutorial.

For a ranking based purely on GitHub activity across the whole catalog, see the 25 best self-hosted apps in 2026.

Before you start: setting up the Pi 5 as a server

• Power supply. Raspberry Pi recommends a 5 V, 5 A USB-C supply such as its own 27 W unit. Weaker supplies limit USB power and cause odd instability under load.
• Cooling. Use the official Active Cooler or a case with a fan. A server runs 24/7, and a throttling Pi feels slow.
• Storage. Boot from an NVMe SSD through an M.2 HAT. MicroSD cards are slow for databases and wear out under constant writes. At the very least, keep app data off the card.
• Operating system. Install 64-bit Raspberry Pi OS Lite (or Ubuntu Server for ARM), enable SSH keys, then install Docker Engine from Docker's repository. Our Docker Compose tutorial covers the rest.
• Images. Before adding any app, confirm its image lists arm64 (sometimes shown as arm64/v8). Everything below does.

A word on value: memory shortages pushed Raspberry Pi prices up three times between December 2025 and April 2026. As of October 2026 the official prices are $175 for 8 GB and $305 for 16 GB, board only. If you are buying from scratch, compare with a used office mini PC in our best mini PC for a home server guide. If you already own a Pi 5, put it to work.

The 15 apps

The always-on essentials (1 to 7)

Pi-hole or AdGuard Home. Blocking ads for the whole network is the job the Pi became famous for, and it barely registers on a Pi 5. Pick one; Pi-hole vs AdGuard Home helps you choose, and the Pi-hole guide walks through setup. Give the Pi a static IP before pointing your router's DNS at it.

Home Assistant. Home Assistant supports the Pi 5 both as a container and as Home Assistant OS. The container works alongside your other apps; Home Assistant OS on a dedicated Pi adds the add-on store and one-click backups. See the Home Assistant guide.

• Pi-hole: Blackhole for Internet advertisements with a GUI for management and monitoring.
• Home Assistant: Home automation platform.
• Vaultwarden: Lightweight Bitwarden server API implementation written in Rust.

Vaultwarden. A Bitwarden-compatible password server in one small Rust binary, ideal for a Pi. Put it behind HTTPS and set up backups before you move your passwords in; the Vaultwarden guide covers both.

Uptime Kuma, Beszel and Homepage. Monitoring and a dashboard cost very little memory. Beszel is especially handy on a Pi because it shows temperature and throttling alongside CPU and RAM. Start with the Uptime Kuma guide.

Files, music and books (8 to 10)

Syncthing keeps folders in sync between your devices and the Pi, which then acts as an always-on peer. The Syncthing guide covers folder permissions.

Navidrome streams your music library to any Subsonic-compatible app. Audio transcoding is cheap, so it runs comfortably on the Pi; see the Navidrome guide. Audiobookshelf does the same for audiobooks and podcasts, with progress sync between phone and web.

Everyday tools (11 to 13)

FreshRSS is a fast, mature RSS reader that works with many mobile apps. Actual is a local-first budgeting app; the Actual guide sets up sync. WG-Easy runs a WireGuard VPN with a simple web UI, so you can reach everything on the Pi from your phone without exposing it to the internet.

The heavier two (14 and 15)

Paperless-ngx. Its documentation states that it runs on a Raspberry Pi, with some tasks slower on low-powered hardware. Expect OCR of long multi-page scans to take a while; day-to-day searching is fast. The project suggests setting PAPERLESS_WEBSERVER_WORKERS to 1 to save memory. Follow the Paperless-ngx guide.

Jellyfin. The Pi 5 has no hardware video encoder, and Jellyfin has deprecated hardware acceleration on Raspberry Pi. It works well when your devices can play the files directly, and poorly when they need transcoding. For a serious media server, read our home server for Plex and Jellyfin guide.

What about Immich?

Immich supports arm64, and many people run it on a Pi 5. But its documentation asks for at least 6 GB of RAM, recommends 8 GB, and says that on 4 GB systems it can run with machine learning disabled. On an 8 GB Pi that already runs a dozen services, either disable machine learning or give Immich a 16 GB Pi or a different machine. The Immich guide shows the settings.

Also runs well on a Pi 5

Linkding for bookmarks, Memos for quick notes, Gitea for Git hosting and ntfy for push notifications all publish arm64 images and stay light.

A sample 8 GB layout

A sensible starting stack on one 8 GB Pi 5: AdGuard Home or Pi-hole, Vaultwarden, Uptime Kuma, Beszel, Homepage, Syncthing, Navidrome and FreshRSS. Add apps one at a time and watch memory in Beszel after each; if free memory stays low, move the heaviest app to another machine rather than relying on swap.

Keep the Pi healthy

• Use bind mounts on the NVMe drive for all app data, and back it up off the Pi.
• Watch temperatures with Beszel; add better cooling if you see throttling.
• Update deliberately with docker compose pull && docker compose up -d.
• Do not expose admin panels; use WG-Easy or Tailscale for remote access.

New to self-hosting? Our homelab for beginners guide explains what to run first, and the network utilities and home automation categories list more apps to try.

The end of self-hosted Jira: key dates

Atlassian has been moving customers to its cloud for years. The self-managed timeline as of October 2026:

Until 2029 Atlassian continues technical support and critical security fixes. After that, the only Atlassian option is Jira Cloud, which runs on Atlassian's infrastructure. For teams with data residency rules, air-gapped networks or a policy of owning their tools, that is the trigger to look elsewhere.

The alternatives at a glance

Plane: the closest Jira replacement

Plane is the most popular open-source issue tracker on GitHub, with about 60,400 stars. It covers the Jira concepts software teams rely on: issues with custom states and properties, cycles for sprints, modules for grouping work, epics, multiple layouts (list, board, spreadsheet, calendar, Gantt) and wiki-style pages. Its interface is closer to Linear than to Jira, which most teams consider an upgrade.

• Plane: Track issues, epics, and product roadmaps in the simplest way possible (alternative to JIRA, Linear and Height).

Plane's Community Edition is AGPL-3.0. Its commercial self-hosted edition adds a Free plan for up to 12 users, Pro at $6 per user per month and Business at $13 per user per month, both billed annually as of October 2026. Its built-in Jira importer is available on every plan, which makes it the easiest migration on this list.

OpenProject: for organisations that need real project management

OpenProject is the most mature tool here and recorded more than 16,000 commits in the past year, the most of any project on this list. Work packages cover tasks, bugs, features and milestones; the Community edition includes Gantt charts, agile boards, time tracking, wikis, meetings and file storage integrations. It suits PMOs, public sector and engineering organisations that need plans, baselines and budgets rather than just a backlog.

The Community edition is GPL-3.0 and free. Enterprise on-premises plans add extra features and vendor support, starting at €5.95 per user per month for Basic with a 25-user minimum, as of October 2026. OpenProject publishes packages for Debian, Ubuntu and RHEL-family systems as well as Docker images.

Taiga: focused agile, slower development

Taiga is a clean Scrum and Kanban tool with backlogs, sprints, user stories, epics and burndown charts, under MPL-2.0. Teams that use Jira mainly for agile boards find it intuitive. The caveat is momentum: its backend repository recorded only 83 commits in the past year, so expect maintenance rather than new features.

Leantime: project management for people who are not project managers

Leantime targets small teams and non-specialists, with tasks, milestones, timesheets, idea boards and lean strategy tools, and a design that explicitly considers users with ADHD, autism and dyslexia. The self-hosted edition is AGPL-3.0 and free; extras such as whiteboards and custom fields are paid plugins. It runs on PHP and MySQL, so it fits on a small VPS.

Huly: the all-in-one option, with a heavy footprint

Huly combines issue tracking with documents, team chat and video calls, positioning itself against Jira, Linear, Slack and Notion at once. It is EPL-2.0 and actively developed. Self-hosting is the heaviest on this list: its documentation asks for at least 2 vCPUs and 8 GB of RAM, recommends 4 vCPUs and 16 GB, and deploys CockroachDB, Elasticsearch, Redpanda and MinIO. The project itself notes that the bundled CockroachDB and Redpanda configurations may not be production-ready, so plan for proper operations work.

• OpenProject: Manage your projects, tasks and goals. Collaborate via work packages and link them to your pull requests on Github.
• Leantime: Lean project management system for small teams and startups helping to manage projects from ideation through delivery.
• Huly: All-in-one project management platform (alternative to Linear, Jira, Slack, Notion, Motion).

Other options

If your code already lives in GitLab, its built-in issues, boards, milestones and epics may be enough; see our GitLab deploy guide. ZenTao is another AGPL-licensed Scrum tool with a strong following in Asia. For lightweight kanban, browse the task management category.

Planning the migration

Treat the move as a project of its own. Start by auditing what your Jira instance actually does: custom fields, workflows, automation rules and Marketplace apps often carry more business logic than people remember. Decide which of those you need on day one and which can be simplified. Run the new tool alongside Jira for one team for a sprint or two, then migrate the remaining projects in batches. Keep a read-only Jira export for audit history, and put the new tool behind single sign-on and regular database backups from the start.

How to choose

• Software team replacing Jira Software: Plane.
• Organisation that needs Gantt, budgets and time tracking: OpenProject.
• Pure Scrum or Kanban, small team: Taiga or Leantime.
• You also want to replace Slack and Confluence: Huly, if you have the hardware.

Whatever you pick, export your Jira data while your Data Center instance is still writable, and migrate one project first. Browse every open-source Jira alternative, the full project management category, and open-source Confluence alternatives for your documentation.

How Tailscale works, and what you can self-host

Tailscale builds a peer-to-peer mesh of WireGuard tunnels between your devices. The data plane is the clients themselves: traffic flows directly between devices, or through DERP relays when a direct connection is impossible. The control server hands out keys, applies access rules and tells devices how to find each other.

Most of Tailscale is open source, but not the control server or the GUI clients for Windows, macOS and iOS. So "self-hosted Tailscale" really means replacing the coordination server, which is exactly what Headscale does.

The options at a glance

Headscale: keep the Tailscale clients, own the server

Headscale aims to be "a self-hosted, open source alternative to the Tailscale control server" for a single tailnet, suitable for personal use or a small organisation. It has about 44,400 GitHub stars and over 1,000 commits in the past year, and one of its active maintainers is employed by Tailscale, although the project is independent.

• Headscale: Open-source, self-hosted implementation of the Tailscale control server.

You point the standard Tailscale apps at your Headscale URL, and most everyday features work. According to its documentation, supported features include MagicDNS and split DNS, ACLs and grants, subnet routers and exit nodes, ephemeral nodes, an embedded DERP server, OIDC login, Taildrop, Taildrive and Tailscale SSH. Funnel, Serve and network flow logs are not supported, and OIDC groups cannot be used in ACLs.

Headscale is a single Go binary with SQLite or PostgreSQL, so it runs comfortably on a small VPS. Management is through the CLI; there is no official web interface, though community front ends exist. It needs a public HTTPS endpoint, so put it behind a reverse proxy with a valid certificate.

NetBird: a complete open-source mesh VPN

NetBird is a WireGuard-based mesh network with everything included: clients for desktop and mobile, a management service, signal and relay servers, and a web dashboard for peers, groups, access policies and DNS. Client code is BSD-3-Clause, while the management, signal and relay components are AGPL-3.0. It has about 29,800 GitHub stars and more than 1,000 commits in the past year.

• NetBird: Zero-config WireGuard-based mesh VPN and secure network access platform.

Its self-hosting quickstart asks for a VM with at least 1 CPU and 2 GB of RAM, a public domain, and open TCP ports 80 and 443 plus UDP 3478. A single script deploys the management, signal and relay servers, a STUN service, the dashboard, an embedded Dex identity provider for local users and a reverse proxy with automatic Let's Encrypt certificates. You can also connect an external identity provider for SSO.

NetBird's cloud has a Free plan for up to 5 users and 100 machines, with Team at €6 and Business at €12 per user per month as of October 2026, so you can trial it before self-hosting.

Simpler options

wg-easy is not a mesh. It runs a single WireGuard server with a clean web UI for creating clients and QR codes. If all you need is to reach your home network from your phone, it is the lightest option, and the standard WireGuard apps work with it.

Pangolin solves a different problem: exposing self-hosted web apps to the internet through a tunnel, with authentication in front, without opening ports at home. It is an alternative to Cloudflare Tunnel and ngrok rather than to a device mesh.

Firezone is Apache-2.0 and well engineered, but its README states that production self-hosting is not officially supported, so treat it as a managed service.

• wg-easy: The easiest way to run WireGuard VPN with a web UI.
• Pangolin: Identity-aware tunneled reverse proxy with dashboard UI, access control, and WireGuard-based tunnels (alternative to Cloudflare Tunnel, Tailscale).

When the free Tailscale plan is the better choice

Self-hosting the control plane gives you control and removes a third-party dependency, but it also makes you responsible for the piece that every device relies on to connect. As of October 2026, Tailscale's Personal plan is free for up to 6 users with unlimited user devices, and paid plans start at $8 per user per month for Standard and $18 for Premium. If you have a small homelab, are happy with a Tailscale account, and want features like Funnel, the free plan is hard to beat.

Self-host when you need the coordination server inside your own infrastructure for compliance or privacy, want no external accounts, have more users than the free tier allows, or simply want to understand and own every layer.

Which should you choose?

• Choose Headscale if you love the Tailscale apps and want a self-hosted control server for yourself, family or a small team.
• Choose NetBird if you want a fully open-source platform with a web dashboard, user management and policies for a team.
• Choose wg-easy if you only need remote access to your home network.
• Choose Pangolin if you want to publish web services securely without port forwarding.

Browse every open-source Tailscale alternative and ngrok alternative, or explore the VPN and proxy and remote access categories. A private mesh is also a safe way to reach services like Jellyfin from outside your home.

What self-hosted Sentry is

Sentry is the most widely used error-tracking platform, and its main repository has about 45,500 GitHub stars. The getsentry/self-hosted repository packages the full product as a Docker Compose stack. You clone the latest release, run ./install.sh, and get the same core error monitoring, performance tracing, session replay and alerting that the cloud version offers.

• Sentry Self-Hosted: Powerful error tracking platform with wide language support and a robust API.

Sentry is licensed under the Functional Source License (FSL-1.1-Apache-2.0). You may use, modify and run it for any purpose except offering a competing commercial product, and each release converts to Apache 2.0 two years after publication. That makes it source-available today rather than OSI open source, though for internal use it imposes no practical restriction.

Requirements

From Sentry's self-hosted documentation, as of October 2026:

Treat the minimum as a floor. Event volume, retention and features such as session replay and tracing drive disk and memory use well above it. ClickHouse and Kafka are both memory-hungry, and running near the limit is the most common cause of a self-hosted install becoming unstable.

The real costs

The licence is free, so the cost is infrastructure and time:

• A large server. A machine with 16 to 32 GB of RAM costs considerably more than the small VPS that runs most self-hosted apps.
• Upgrades. Sentry publishes a new CalVer release every month (26.9.0 shipped on September 15, 2026). Upgrades run migrations across several datastores and sometimes require stepping through intermediate versions, so you should not fall far behind.
• Operations. Kafka, ClickHouse, Redis, PostgreSQL, Snuba, Relay and Symbolicator each need monitoring, backups and disk management.
• No support. Sentry states that the self-hosted version comes with no guarantees or dedicated support; help comes from the community Discord.
• Missing features. Billing-linked features such as spike protection and spend allocation, the Seer AI features, some iOS symbolication and console platform support are unavailable.

Compare that with Sentry's cloud as of October 2026: the Developer plan is free for one user with 5,000 errors a month, Team costs $26 a month and Business $80 a month, both with unlimited users. For small teams, the cloud can be cheaper than the server alone.

GlitchTip: the lightweight, MIT-licensed option

GlitchTip is an open-source error tracker under the MIT licence that implements Sentry's event ingestion API, so the official Sentry SDKs work by changing only the DSN. It covers error tracking, basic performance monitoring and uptime checks, and deliberately skips Sentry's heavier features.

Its documentation recommends 512 MB of RAM and allows 256 MB in all-in-one mode. It needs PostgreSQL 14 or later; Valkey or Redis is optional for faster or larger instances, and without it PostgreSQL handles the task queue and cache. The project estimates that about one million events a month may need 30 GB of disk. GlitchTip also offers hosted plans, from a free tier with 1,000 events a month to $15 a month for 100,000 events, as of October 2026.

Bugsink: a single container, source-available

Bugsink is a self-hosted error tracker designed for simplicity. It runs as one Docker container with SQLite, or with MySQL or PostgreSQL for larger setups, and it is compatible with Sentry's SDKs through the DSN. Self-hosting is free with unlimited users and all features; paid support and hosted plans are optional.

• Bugsink: Real-time error tracking for your applications with all the details in one place. Easy setup with clear instructions included.

The licence caveat: Bugsink's code is under the PolyForm Shield License 1.0.0, which permits use but forbids building a competing product. It is source-available, not open source. For internal error tracking that rarely matters, but know it before you standardise on it.

Sentry vs GlitchTip vs Bugsink

Rounding out your monitoring

Error tracking is one layer. For uptime and status pages, Uptime Kuma is the standard choice, with its own deploy guide. For distributed tracing, logs and metrics on OpenTelemetry, SigNoz covers ground that GlitchTip and Bugsink do not.

• Uptime Kuma: Easy-to-use self-hosted uptime monitor with status pages and 90+ notification channels.
• SigNoz: Open-source observability platform for logs, metrics and traces built on OpenTelemetry.

Switching between them

Because all three accept the Sentry SDK protocol, moving is mostly a configuration change: create a project in the new tool, copy its DSN into your application's environment variables, and redeploy. Historical issues do not migrate, so run old and new side by side until the old retention window expires. Source maps and release tracking are uploaded with the same sentry-cli workflow, though support varies, so test one service first.

Which should you choose?

• Choose Sentry self-hosted if you need tracing, session replay and the full feature set, must keep data on your own infrastructure, and can dedicate a large server and regular maintenance.
• Choose GlitchTip if you want an MIT-licensed, Sentry-compatible error tracker that runs on almost anything.
• Choose Bugsink if you want the simplest deployment and a source-available licence is acceptable.
• Choose Sentry's cloud if your team is small and nobody wants to run Kafka.

See every open-source Sentry alternative and Datadog alternative, or browse the monitoring and developer tools categories.

What each one is

Bitwarden is the open-source password manager from Bitwarden, Inc. Its server is licensed under AGPL-3.0, with some enterprise code under the separate Bitwarden License. You can use Bitwarden's cloud or host the server yourself.

Vaultwarden, formerly bitwarden_rs, is an unofficial server written in Rust that implements the Bitwarden client API. It is AGPL-3.0 licensed, not affiliated with Bitwarden, Inc., and works with all official Bitwarden clients. It is one of the most popular self-hosted apps on GitHub, with about 68,600 stars.

• Vaultwarden: Lightweight Bitwarden server API implementation written in Rust.
• Bitwarden: Password manager with a webapp, browser extension, and mobile app.

Side-by-side comparison

Resources and setup

Vaultwarden's biggest practical advantage is size. It is a single binary that stores everything in SQLite by default, so a Raspberry Pi or a $4 VPS is more than enough for a family. Configuration is a handful of environment variables, and backups are mostly one database file plus an attachments folder. Our Vaultwarden deploy guide covers the full Docker Compose setup with HTTPS.

Official Bitwarden used to be the opposite: about a dozen containers, Microsoft SQL Server and at least 2 GB of RAM. That standard deployment still exists and is the right choice for large organizations. But in December 2025 the single-container Bitwarden Unified image exited beta and was renamed Bitwarden lite. Lite needs at least 200 MB of RAM, supports SQLite, PostgreSQL, MySQL/MariaDB and MSSQL, and runs on ARM boards and NAS devices. You still need a free installation ID and key from Bitwarden to set it up.

Features and licensing

This is where the two diverge most. Self-hosting Bitwarden is free, but features beyond the free plan need a license file tied to a paid subscription. That covers individual premium features such as advanced two-factor options, file attachments and emergency access, and organization features such as shared collections beyond the free limits, groups and policies. Current Bitwarden prices, billed annually, are $19.80 per year for Premium, $47.88 per year for Families (up to six users), $4 per user per month for Teams and $6 per user per month for Enterprise.

Vaultwarden includes the equivalents without any license: organizations with collections, groups and member roles, event logs, policies, emergency access, file attachments, Send, and two-factor authentication through authenticator apps, email, FIDO2 WebAuthn, YubiKey and Duo. It also has an admin panel for managing users. For a household, that is everything Bitwarden Families offers.

The trade-off is that Vaultwarden occasionally lags behind new Bitwarden features, because the maintainers reimplement each API change after Bitwarden ships it. Brand-new client features can take a few releases to arrive.

Security and trust

Your vault is encrypted and decrypted on your device by the official Bitwarden clients in both cases, so the server never sees your master password or your plaintext passwords. That limits what a server bug can expose, but it does not make the server irrelevant: authentication, organization access and admin functions still live there.

Bitwarden publishes annual third-party audits, including multiple Cure53 assessments in 2025, and holds SOC 2 Type 2 and ISO 27001 certifications. Vaultwarden has never commissioned its own audit. Its wiki lists a static and dynamic test of version 1.30.3 by Germany's Federal Office for Information Security (BSI), published in 2024, and a 2024 ERNW penetration test that found three vulnerabilities, including an authentication bypass, which were fixed and disclosed. The project is actively maintained; version 1.37.4 shipped on October 5, 2026.

Whichever you choose, the biggest security wins are the same: keep the server updated, do not expose the admin panel publicly, enforce two-factor authentication and back up the database off-site.

Which should you choose?

Choose Vaultwarden if you are self-hosting for yourself, your family or a small group of friends, you want every feature without paying, and you are comfortable reading release notes and updating promptly.

Choose self-hosted Bitwarden if you are a company with compliance requirements, you need vendor support and audit reports for your security review, or you want features the day they ship. Bitwarden lite makes this realistic even on small hardware.

Choose Bitwarden's cloud if you do not want to run a server at all. It is the same software with the operational work done for you.

For teams that need per-user sharing with PGP-based encryption, Passbolt is another self-hosted option worth a look.

The verdict

For a home lab, Vaultwarden is hard to beat: tiny, complete and free. For a business, the official server is the defensible choice. Either way you keep the same excellent Bitwarden apps. Compare every self-hosted password manager, see the full list of open-source alternatives to 1Password and Bitwarden alternatives, go straight to the Vaultwarden guide, or check the live GitHub stats in our Vaultwarden vs Bitwarden data comparison.